Most recent entries from all

EUVD-2026-355086

fkie_cve-2026-63336

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) configure com.rabbitmq.client.TrustEverythingTrustManager and leave hostname verification disabled, causing arbitrary server certificates, including self-signed certificates, to be accepted. A network attacker able to intercept a TLS connection can impersonate the RabbitMQ broker, read protected AMQP traffic, and modify traffic without certificate or hostname validation. The fix changes the production TLS helpers to use the JVM default trust store and enables hostname verification, while retaining an explicitly named development-only no-verification helper. This issue is fixed in version 5.33.0.

GHSA-5m9f-rphj-c435 — RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

Affected: Maven: com.rabbitmq:amqp-client

## Vulnerability Summary

`com.rabbitmq.client.TrustEverythingTrustManager` accepts ANY TLS certificate (including null chains) and is used as the default trust manager when calling `ConnectionFactory.useSslProtocol()` without arguments. Combined with hostname verification being disabled by default, this enables trivial man-in-the-middle attacks.

## Affected Components

- `com.rabbitmq.client.TrustEverythingTrustManager` — accepts any certificate - `com.rabbitmq.client.ConnectionFactory.useSslProtocol()` — uses TrustEverythingTrustManager - Hostname verification disabled by default (`enableHostnameVerification()` must be called explicitly) - `com.rabbitmq.client.ConnectionFactory.getPassword()` — returns plaintext with no redaction - Default port 5672 (plaintext) with PLAIN SASL — credentials sent unencrypted

## POC (Verified on Java 21, amqp-client 5.25.0)

```java // TrustEverythingTrustManager accepts ANY certificate including null TrustEverythingTrustManager tm = new TrustEverythingTrustManager(); tm.checkServerTrusted(null, "RSA"); // No exception — accepts null cert chain tm.getAcceptedIssuers(); // Returns empty array — trusts all CAs

// ConnectionFactory defaults ConnectionFactory factory = new ConnectionFactory(); factory.useSslProtocol(); // Uses TrustEverythingTrustManager internally // enableHostnameVerification() NOT called by default

// Credential exposure factory.setPassword("secret_password_123"); factory.getPassword(); // Returns "secret_password_123…

OESA-2026-4112 — rabbitmq-java-client security update

Affected: openEuler:24.03-LTS-SP3: rabbitmq-java-client, openEuler:24.03-LTS-SP4: rabbitmq-java-client, openEuler:20.03-LTS-SP4: rabbitmq-java-client, openEuler:22.03-LTS-SP4: rabbitmq-java-client, openEuler:24.03-LTS-SP1: rabbitmq-java-client

The library allows Java code to interface to AMQP servers. Please see the specification page for more information on AMQP inter-operation and standards-conformance You will need an AMQP server, such as our very own RabbitMQ server, to use with the client library. Security Fix(es):

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0.(CVE-2023-46120)

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP frame_max value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and NettyFrameHandlerFactory continue to validate broker-controlled frame payload lengths against maxInboundMessageBodySize because the negotiated limit is not applied consistently through setMaxInboundFramePayloadSize. A malicious or compromised broker can send a method frame larger than the negotiated frame_max during or after connection establishment, causing the client to allocate and decode a protocol-invalid frame instead of rejecting it with Ma…

UBUNTU-CVE-2026-63336

Affected: Ubuntu:18.04:LTS: rabbitmq-java-client, Ubuntu:20.04:LTS: rabbitmq-java-client, Ubuntu:22.04:LTS: rabbitmq-java-client, Ubuntu:24.04:LTS: rabbitmq-java-client, Ubuntu:26.04:LTS: rabbitmq-java-client

WID-SEC-W-2026-2921 — RabbitMQ Java Client: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen im RabbitMQ Java Client ausnutzen, um Code auszuführen, um Sicherheitsmechanismen zu umgehen und um einen Denial of Service herbeizuführen.