RHLW-2026-45242cd5d8021673

    Dashboard / Vulnerabilities / RHLW-2026-45242cd5d8021673

    RHLW-2026-45242cd5d8021673

    Published: 6 Nov 2026Last Modified: 6 Nov 2026

    Summary: Lightwell Security Advisory: amqp-client 5.25.0.rhlw-00028

    Details: Red Hat Lightwell has released com.rabbitmq:amqp-client 5.25.0.rhlw-00028 with backported fixes for CVE-2026-106121, CVE-2026-106122, CVE-2026-106123, CVE-2026-61634, CVE-2026-63335, CVE-2026-63336, CVE-2026-63337, CVE-2026-69219, and CVE-2026-69220. CVE-2026-106121: RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS CVE-2026-106122: RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers CVE-2026-106123: RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() CVE-2026-61634: RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max CVE-2026-63335: RabbitMQ Java client malformed body frame triggers raw command assembler exception CVE-2026-63336: RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM CVE-2026-63337: RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading CVE-2026-69219: RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation CVE-2026-69220: RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS This patched artifact is a drop-in replacement for com.rabbitmq:amqp-client 5.25.0 from Maven Central.

    References: https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.37.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106121.json, https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-cqgh-8p3p-mx4m, https://nvd.nist.gov/vuln/detail/CVE-2026-106121, https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41, https://github.com/rabbitmq/rabbitmq-java-client/pull/2100, https://github.com/advisories/GHSA-cqgh-8p3p-mx4m, https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.36.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106122.json, https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-7822-rcf6-97fx, https://nvd.nist.gov/vuln/detail/CVE-2026-106122, https://github.com/rabbitmq/rabbitmq-java-client/commit/b8bd750fa8c90690e859b18d6343b34421309020, https://github.com/rabbitmq/rabbitmq-java-client/pull/2065, https://github.com/advisories/GHSA-7822-rcf6-97fx, https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.35.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106123.json, https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-h6w7-qmcm-q6xr, https://nvd.nist.gov/vuln/detail/CVE-2026-106123, https://github.com/rabbitmq/rabbitmq-java-client/commit/daca1875cdb8b8c0acce78f71103b21a05478446, https://github.com/rabbitmq/rabbitmq-java-client/pull/2052, https://github.com/advisories/GHSA-h6w7-qmcm-q6xr, https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61634.json, https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5xwg-cfvj-gff5, https://nvd.nist.gov/vuln/detail/CVE-2026-61634, https://github.com/rabbitmq/rabbitmq-java-client/commit/08790f09686173eb17b48d08a25edcb32e71a591, https://github.com/rabbitmq/rabbitmq-java-client/commit/b491075f42e89967610c40beded68d3680cfd472, https://github.com/rabbitmq/rabbitmq-java-client/pull/1994, https://github.com/rabbitmq/rabbitmq-java-client/pull/1995, https://github.com/advisories/GHSA-5xwg-cfvj-gff5, https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.31.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63335.json, https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-qx7j-jv8m-fppr, https://nvd.nist.gov/vuln/detail/CVE-2026-63335, https://github.com/rabbitmq/rabbitmq-java-client/commit/31735344d9f9dfc53740b67f06e560e8846b9322, https://github.com/rabbitmq/rabbitmq-java-client/commit/abd6d60d4e2bfc1a327dc90ab246b2e8aca1f33b, https://github.com/rabbitmq/rabbitmq-java-client/pull/1959, https://github.com/rabbitmq/rabbitmq-java-client/pull/1960, https://github.com/advisories/GHSA-qx7j-jv8m-fppr, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63336.json, https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435, https://nvd.nist.gov/vuln/detail/CVE-2026-63336, https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339, https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01, https://github.com/rabbitmq/rabbitmq-java-client/pull/1999, https://github.com/rabbitmq/rabbitmq-java-client/pull/2001, https://github.com/advisories/GHSA-5m9f-rphj-c435, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63337.json, https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-6g32-pxv4-2wfj, https://nvd.nist.gov/vuln/detail/CVE-2026-63337, https://github.com/rabbitmq/rabbitmq-java-client/commit/0032f75f9dc3df847f94b2b85a16119250bf63cb, https://github.com/rabbitmq/rabbitmq-java-client/commit/9f8e7efd0c648f235dc0e96232ae7efa75ea4fa8, https://github.com/rabbitmq/rabbitmq-java-client/pull/2000, https://github.com/rabbitmq/rabbitmq-java-client/pull/2002, https://github.com/advisories/GHSA-6g32-pxv4-2wfj, https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69219.json, https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-68mj-5wr7-6fgg, https://nvd.nist.gov/vuln/detail/CVE-2026-69219, https://github.com/rabbitmq/rabbitmq-java-client/commit/388209356c6478088efce4d8a07b68e73837a7a0, https://github.com/rabbitmq/rabbitmq-java-client/commit/6a87a8dcdc8b4cc4b961a7cdd388276446e5dfb2, https://github.com/rabbitmq/rabbitmq-java-client/pull/2007, https://github.com/rabbitmq/rabbitmq-java-client/pull/2008, https://github.com/advisories/GHSA-68mj-5wr7-6fgg, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69220.json, https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-93j5-89vc-pph4, https://nvd.nist.gov/vuln/detail/CVE-2026-69220, https://github.com/rabbitmq/rabbitmq-java-client/commit/09af76fce136f3136931654a0a1d43095c80e2f0, https://github.com/rabbitmq/rabbitmq-java-client/commit/db89e34809fbc6ba4e946615f297f3684ccd0acc, https://github.com/advisories/GHSA-93j5-89vc-pph4

    Affected packages

    Package

    Name: com.rabbitmq:amqp-client

    Purl: pkg:maven/com.rabbitmq/amqp-client

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -5.25.0.rhlw-00028

    Affected versions

    1.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    RHLW-2026-45242cd5d8021673 | CVE-DB