CVE-2026-106121 RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
A truncated JSON input in the RabbitMQ Java client causes infinite loops or heap exhaustion, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106121?
CVE-2026-106121 is a medium-severity denial of service vulnerability in com.rabbitmq amqp-client, published on 6 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.
Weakness: CWE-835
Which versions are affected by CVE-2026-106121?
2 open source packages ship an affected version, including com.rabbitmq:amqp-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.rabbitmq:amqp-client Maven | All versions | 5.36.1 |
com.rabbitmq:amqp-client Maven | All versions | 5.36.1 |
Products include Vmware Rabbitmq Java Client.
How do I fix CVE-2026-106121?
Upgrade com.rabbitmq:amqp-client to 5.36.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-106121 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-106121 exists.
Other vulnerabilities in com.rabbitmq amqp-client
- CVE-2026-106122 RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers
- CVE-2026-106123 RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
- CVE-2023-46120 RabbitMQ Java client's lack of message size limitation leads to remote DoS attack
Sources
Also known as CLEANSTART-2026-DZ14042, CLEANSTART-2026-HP65010, CLEANSTART-2026-VT81725, DEBIAN-CVE-2026-106121, ECHO-8457-14d3-7547, GHSA-cqgh-8p3p-mx4m and 12 more.