Denial of Service Vulnerability in RabbitMQ Java Client Library
CVE-2026-63335

6.3MEDIUM

Key Information:

Vendor

RabbitMQ

Status
RabbitMQ-java-client
Vendor
CVE Published:
18 August 2026

What is CVE-2026-63335?

The RabbitMQ Java client library has a vulnerability that could lead to denial of service due to improper handling of inbound AMQP command assembly. An attacker can exploit this by sending a malformed sequence on an open channel, which may crash the client connection. This issue has been addressed in version 5.31.0, enhancing the library's security against such attacks.

Affected Version(s)

rabbitmq-java-client < 5.31.0

References

https://github.com/rabbitmq/rabbitmq-java-client/security...
x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-java-client/pull/1959
x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-java-client/pull/1960
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.