Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-106121 medium CVSS 4.9

Vulnerability in com.rabbitmq:amqp-client (CVE-2026-106121)

Summary

Vulnerability in com.rabbitmq:amqp-client (CVE-2026-106121). Risk of unauthorized operations or information disclosure. Exploitable via CharacterIterator.DONE. Mitigation: upgrade to 5.36.1 or later.

Original description

The description as published by the source.

Summary

com.rabbitmq.tools.json.JSONReader.read() never returns when its input ends inside a quoted string or a // line comment. Both scanners walk the input with StringCharacterIterator.next() but only compare against a delimiter, so once the iterator reaches CharacterIterator.DONE (￿) they loop forever. The string scanner (string(), line 210, while (c != sep)) also appends ￿ to a StringBuilder every iteration, so it fills the heap and throws OutOfMemoryError, taking down the JVM. The comment scanner (skipWhiteSpace(), lines 89-92, while (c != '\n')) pins a thread at 100% CPU with no allocation.

This is reachable with a single message. JsonRpcServer and JsonRpcClient fall back to DefaultJsonRpcMapper whenever no mapper is passed (JsonRpcServer.java:84 and :114, JsonRpcClient.java:186), and that mapper hands the raw message body straight to JSONReader.read() (DefaultJsonRpcMapper.java:42 for the server request, :52 for the client reply). A caller that can publish to the RPC request queue hangs the server; a malicious or MITM'd JSON-RPC service does the same to a client.

Proof of concept

Against amqp-client 5.36.0 from Maven Central:

import com.rabbitmq.tools.jsonrpc.DefaultJsonRpcMapper;

public class Poc {
    public static void main(String[] args) {
        DefaultJsonRpcMapper mapper = new DefaultJsonRpcMapper();
        mapper.parse("{\"method\":\"x", String.class); // unterminated string
        // mapper.par…

Source: NIST National Vulnerability Database NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-106121 has been found in com.rabbitmq:amqp-client.
Attackers can target a specific entry point like CharacterIterator.DONE over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 4.9/10.
What to do: upgrade com.rabbitmq:amqp-client to 5.36.1 or later.
If unsure, ask your IT team or search "com.rabbitmq:amqp-client CVE-2026-106121" on the vendor's site.

CVE-2026-106121 (com.rabbitmq:amqp-client) — CWE-835 / CVSS v3 4.9
Attack vector: remote (network-reachable) / no user interaction
Attack surface: CharacterIterator.DONE / StringBuilder / OutOfMemoryError / JsonRpcServer
Patched: 5.36.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

A vulnerability (CWE-835) exists in com.rabbitmq:amqp-client. Attackers reach the vulnerable code path via CharacterIterator.DONE.

📍 Affected scope

Check the vendor advisory for the affected versions of com.rabbitmq:amqp-client. Attack surface: CharacterIterator.DONE / StringBuilder / OutOfMemoryError / JsonRpcServer.

🔥 Severity

Severity: Medium (CVSS 4.9/10). Risk of unauthorized operations or information disclosure.

🔧 How to fix

Update to 5.36.1.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Audit SBOM/dependencies to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    Audit SBOM/dependencies for affected components.

    資産台帳・SBOM・依存マニフェストで com.rabbitmq:amqp-client を使っているサービスとバージョンを洗い出す。

  2. 2
    Apply patch patch 
    Upgrade com.rabbitmq:amqp-client to 5.36.1

    ステージング環境で 5.36.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

maven com.rabbitmq:amqp-client
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.36.1"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details