Description officielle (NVD)

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by ValueWriter.writeShortstr. An attacker who can submit an RPC message with a malformed echoed property can cause reply publication in RpcServer.mainloop() or tutorial-style consumers to throw an unchecked exception before acknowledgement. The broker requeues the message, allowing the same message to disable replacement consumers until the queue is purged. This issue is fixed in version 5.36.0.

Références

https://github.com/rabbitmq/rabbitmq-java-client/commit/b8bd750fa8c90690e859b18d6343b34421309020 , Patch
https://github.com/rabbitmq/rabbitmq-java-client/pull/2065 , Patch
https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.36.0 , Release Notes
https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-7822-rcf6-97fx , Exploit, Vendor Advisory
https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-7822-rcf6-97fx , Exploit, Vendor Advisory

En bref

Éditeur	vmware
Produit	rabbitmq_java_client
Publiée le	06/10/2026
Modifiée le	09/10/2026
CVSS	6.0 (v4.0)
EPSS	0,48 % (centile 40)
CWE	CWE-172, CWE-248

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS : probabilité estimée d'exploitation dans les 30 prochains jours.