All vulnerabilities
CVE-2026-106121GHSA-cqgh-8p3p-mx4m

com.rabbitmq:amqp-client: RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

rabbitmq com.rabbitmq:amqp-clientmavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
4.9Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 6 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.50%Chance of exploitation activity in the next 30 days, higher than 42% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5.36.1Fixed versionGitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 5.36.1com.rabbitmq:amqp-client, mavenGitHub<dependency><groupId>com.rabbitmq</groupId><artifactId>amqp-client</artifactId><version>5.36.1</version></dependency>
  • 5.36.1com.rabbitmq:amqp-client, MavenOSV<dependency><groupId>com.rabbitmq</groupId><artifactId>amqp-client</artifactId><version>5.36.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

com.rabbitmq.tools.json.JSONReader.read() never returns when its input ends inside a quoted string or a // line comment. Both scanners walk the input with StringCharacterIterator.next() but only compare against a delimiter, so once the iterator reaches CharacterIterator.DONE (￿) they loop forever. The string scanner (string(), line 210, while (c != sep)) also appends ￿ to a StringBuilder every iteration, so it fills the heap and throws OutOfMemoryError, taking down the JVM. The comment scanner (skipWhiteSpace(), lines 89-92, while (c != '\n')) pins a thread at 100% CPU with no allocation.

This is reachable with a single message. JsonRpcServer and JsonRpcClient fall back to DefaultJsonRpcMapper whenever no mapper is passed (JsonRpcServer.java:84 and :114, JsonRpcClient.java:186), and that mapper hands the raw message body straight to JSONReader.read() (DefaultJsonRpcMapper.java:42 for the server request, :52 for the client reply). A caller that can publish to the RPC request queue hangs the server; a malicious or MITM'd JSON-RPC service does the same to a client.

Proof of concept

Against amqp-client 5.36.0 from Maven Central:

import com.rabbitmq.tools.jsonrpc.DefaultJsonRpcMapper;

public class Poc {
    public static void main(String[] args) {
        DefaultJsonRpcMapper mapper = new DefaultJsonRpcMapper();
        mapper.parse("{\"method\":\"x", String.class); // unterminated string
        // mapper.parse("//", String.class);           // unterminated // comment
        System.out.println("unreachable");
    }
}

java -Xmx64m -cp amqp-client-5.36.0.jar:. Poc throws OutOfMemoryError: Java heap space in about 0.1s and never prints. Swapping in the // line spins at 100% CPU and never returns. A well-formed body such as {"method":"x"} returns immediately.

Impact

Availability. One small, unauthenticated message stops a JSON-RPC endpoint: the unterminated string exhausts the heap, the unterminated comment pins a thread forever. Neither is recoverable per request - JsonRpcServer.doCall only catches ClassCastException, and an OutOfMemoryError affects the whole process.

Scope and fix

Only applications using the JSON-RPC-over-AMQP tooling (com.rabbitmq.tools.jsonrpc) with the default DefaultJsonRpcMapper are affected. DefaultJsonRpcMapper and JSONReader are deprecated in favour of JacksonJsonRpcMapper, but both still ship and remain the default when no mapper is supplied. The fix is to stop both loops at CharacterIterator.DONE.

Text from GitHub Advisory Database

Affected versions 54

  • com.rabbitmq:amqp-client, maven<= 5.36.0GitHub
  • rabbitmq-java-clientaffected: < 5.36.1CVE List
  • amqp-clientaffected: < 5.36.1CVE List
  • com.rabbitmq:amqp-client, Mavenfrom first release, fixed in 5.36.1OSV
  • com.rabbitmq:amqp-client, Maven1.3.0OSV
  • com.rabbitmq:amqp-client, Maven1.5.4OSV
  • com.rabbitmq:amqp-client, Maven1.5.5OSV
  • com.rabbitmq:amqp-client, Maven1.6.0OSV
  • com.rabbitmq:amqp-client, Maven1.7.2OSV
  • com.rabbitmq:amqp-client, Maven1.8.0OSV
  • com.rabbitmq:amqp-client, Maven1.8.1OSV
  • com.rabbitmq:amqp-client, Maven2.0.0OSV
  • com.rabbitmq:amqp-client, Maven2.1.0OSV
  • com.rabbitmq:amqp-client, Maven2.1.1OSV
  • com.rabbitmq:amqp-client, Maven2.2.0OSV
  • com.rabbitmq:amqp-client, Maven2.3.0OSV
  • com.rabbitmq:amqp-client, Maven2.3.1OSV
  • com.rabbitmq:amqp-client, Maven2.4.1OSV
  • com.rabbitmq:amqp-client, Maven2.5.0OSV
  • com.rabbitmq:amqp-client, Maven2.5.1OSV
  • com.rabbitmq:amqp-client, Maven2.6.0OSV
  • com.rabbitmq:amqp-client, Maven2.6.1OSV
  • com.rabbitmq:amqp-client, Maven2.7.0OSV
  • com.rabbitmq:amqp-client, Maven2.7.1OSV
  • com.rabbitmq:amqp-client, Maven2.8.0OSV
  • com.rabbitmq:amqp-client, Maven2.8.1OSV
  • com.rabbitmq:amqp-client, Maven2.8.2OSV
  • com.rabbitmq:amqp-client, Maven2.8.3OSV
  • com.rabbitmq:amqp-client, Maven2.8.4OSV
  • com.rabbitmq:amqp-client, Maven2.8.5OSV
  • com.rabbitmq:amqp-client, Maven2.8.6OSV
  • com.rabbitmq:amqp-client, Maven2.8.7OSV
  • com.rabbitmq:amqp-client, Maven3.0.0OSV
  • com.rabbitmq:amqp-client, Maven3.0.1OSV
  • com.rabbitmq:amqp-client, Maven3.0.2OSV
  • com.rabbitmq:amqp-client, Maven3.0.3OSV
  • com.rabbitmq:amqp-client, Maven3.0.4OSV
  • com.rabbitmq:amqp-client, Maven3.1.0OSV
  • com.rabbitmq:amqp-client, Maven3.1.1OSV
  • com.rabbitmq:amqp-client, Maven3.1.2OSV
  • com.rabbitmq:amqp-client, Maven3.1.3OSV
  • com.rabbitmq:amqp-client, Maven3.1.4OSV
  • com.rabbitmq:amqp-client, Maven3.2.0OSV
  • com.rabbitmq:amqp-client, Maven3.2.1OSV
  • com.rabbitmq:amqp-client, Maven3.2.2OSV
  • com.rabbitmq:amqp-client, Maven3.2.3OSV
  • com.rabbitmq:amqp-client, Maven3.2.4OSV
  • com.rabbitmq:amqp-client, Maven3.3.0OSV
  • com.rabbitmq:amqp-client, Maven3.3.1OSV
  • com.rabbitmq:amqp-client, Maven3.3.2OSV
  • com.rabbitmq:amqp-client, Maven3.3.3OSV
  • com.rabbitmq:amqp-client, Maven3.3.4OSV
  • com.rabbitmq:amqp-client, Maven3.3.5OSV
  • com.rabbitmq:amqp-client, Maven3.4.0OSV

References 6