CVE-2026-63337: RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
The JSON-RPC tools in com.rabbitmq.tools.jsonrpc perform Class.forName(javaReturnType) with initialize=true on class names received from untrusted AMQP messages, without any validation or allowlist.
Vulnerable code (ProcedureDescription.java:101-127): When a JsonRpcClient connects, it calls system.describe and receives a service description from the AMQP queue. The response JSON includes javaReturnType fields that are reflectively set via JSONUtil.tryFill(), triggering setJavaReturnType() → computeReturnTypeAsJavaClass() → Class.forName(javaReturnType).
Attack scenario: 1. Victim uses JsonRpcClient to connect to a JSON-RPC service via RabbitMQ 2. Attacker (co-tenant on shared broker, or MITM) intercepts the system.describe request 3. Attacker responds with crafted javaReturnType values 4. Victim's client calls Class.forName(attackerInput) with default initialize=true 5. Static initializers of attacker-specified classes execute in victim's JVM
Additionally, the loaded class from getReturnType() is passed to mapper.parse(replyStr, expectedType) at JsonRpcClient.java:168, potentially enabling type-confusion.
Recommended fix: Use Class.forName(javaReturnType, false, classLoader) to prevent static initializer execution, or add an allowlist of permitted return types.
CWE: CWE-470
---
Reply from reporter (2026-06-29): Thanks for the quick turnaround. Fix looks good. Looking forward to the CVE assignment.
Other sources
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.tools.jsonrpc.ProcedureDescription receives a javaReturnType value in an untrusted system.describe response and passes it through JSONUtil.tryFill, setJavaReturnType, and computeReturnTypeAsJavaClass to Class.forName(javaReturnType) with initialization enabled. An attacker able to answer the JsonRpcClient request through a shared broker or network interception can select a class already present in the victim JVM and trigger its static initializer, while JsonRpcClient.java later passes getReturnType output to mapper.parse and may also create type confusion. Successful exploitation can affect confidentiality, integrity, and availability in the client process. This issue is fixed in version 5.33.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/com.rabbitmq:amqp-clientto a version that resolves this vulnerability.Fixed in 5.33.0 - Upgrade
Upgrade
com.rabbitmq.tools.jsonrpcto a version that resolves this vulnerability.Fixed in 5.33.0 - Configuration
In ProcedureDescription, change class loading to use Class.forName(javaReturnType, false, classLoader) so static initializers are not executed for attacker-controlled javaReturnType.
com.rabbitmq.tools.jsonrpc.ProcedureDescription Class.forName(javaReturnType, initialize, classLoader) = Class.forName(javaReturnType, false, classLoader) - Configuration
Add validation/allowlist logic so javaReturnType values from untrusted system.describe responses are restricted to permitted return types before calling Class.forName.
com.rabbitmq.tools.jsonrpc.ProcedureDescription Allowed javaReturnType values = Implement an allowlist of permitted return types
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Applications using JsonRpcClient in RabbitMQ Java client versions earlier than 5.33.0 are affected when they accept an untrusted system.describe response. Exposure exists if an attacker can answer the JsonRpcClient request through a shared broker or by intercepting network traffic.
What access does an attacker need to exploit this?
The attacker must be able to supply the system.describe response received by JsonRpcClient, such as through control of responses on a shared broker or network interception. They can choose a class already available in the victim JVM, causing Class.forName to load it with class initialization enabled.
What should we do if affected?
Upgrade the RabbitMQ Java client library to version 5.33.0, which fixes the issue. The provided information does not specify an alternative configuration-based mitigation.
How can we determine whether an application is affected?
Identify applications that use JsonRpcClient and determine their RabbitMQ Java client version. Versions earlier than 5.33.0 should be treated as affected where system.describe responses can be untrusted.