CVE-2026-106122 RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers
An attacker can permanently disable RPC consumers in RabbitMQ Java client applications by sending malformed UTF-8 properties, causing unchecked exceptions and message requeuing.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106122?
CVE-2026-106122 is a medium-severity denial of service vulnerability in com.rabbitmq amqp-client, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by ValueWriter.writeShortstr. An attacker who can submit an RPC message with a malformed echoed property can cause reply publication in RpcServer.mainloop() or tutorial-style consumers to throw an unchecked exception before acknowledgement. The broker requeues the message, allowing the same message to disable replacement consumers until the queue is purged. This issue is fixed in version 5.36.0.
Which versions are affected by CVE-2026-106122?
2 open source packages ship an affected version, including com.rabbitmq:amqp-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.rabbitmq:amqp-client Maven | All versions | 5.36.0 |
com.rabbitmq:amqp-client Maven | All versions | 5.36.0 |
Products include Vmware Rabbitmq Java Client.
How do I fix CVE-2026-106122?
Upgrade com.rabbitmq:amqp-client to 5.36.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-106122 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-106122 exists.
Other vulnerabilities in com.rabbitmq amqp-client
- CVE-2026-106123 RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
- CVE-2026-106121 RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
- CVE-2023-46120 RabbitMQ Java client's lack of message size limitation leads to remote DoS attack
Sources
Also known as CLEANSTART-2026-JZ50665, CLEANSTART-2026-MV69619, CLEANSTART-2026-TG95490, DEBIAN-CVE-2026-106122, ECHO-4250-102d-5acc, GHSA-7822-rcf6-97fx and 12 more.