SSL Configuration Vulnerability in RabbitMQ Java Client Library

CVE-2026-63336

What is CVE-2026-63336?

The RabbitMQ Java client library has a vulnerability that allows attackers to exploit unsecured TLS connections. Prior to version 5.33.0, the library's configuration permitted the use of arbitrary server certificates, including self-signed ones, by defaulting to a TrustEverythingTrustManager and disabling hostname verification. This oversight could expose protected AMQP traffic to interception and modification by malicious actors capable of man-in-the-middle attacks. The vulnerability has been mitigated in version 5.33.0, which implements the JVM default trust store and enforces hostname verification, improving the security of connections to RabbitMQ nodes.

References