RHLW-2026-45242cd5d8021673: Lightwell Security Advisory: amqp-client 5.25.0.rhlw-00028

Q: Which application paths are most relevant when assessing exposure?

Applications using the Java client's JSON-RPC functionality are relevant to the truncated-input denial of service, malformed UTF-8 RPC-consumer failure, and unvalidated class loading issues. Applications that process broker frames are relevant to the oversized-frame, malformed-body-frame, and oversized LongString or bytes allocation issues.

Q: Does TLS use require special attention?

Yes. The advisory states that TrustEverythingTrustManager is used by default by useSslProtocol(), which can enable a man-in-the-middle attack. Review applications that call useSslProtocol() and their TLS trust configuration.

Q: What does an attacker need to target the broker-frame issues?

The affected client must process malicious or malformed broker frames, including frames larger than the negotiated AMQP frame_max, malformed body frames, or oversized LongString or bytes lengths. The stated impacts include exceptions and unchecked allocation that can cause out-of-memory conditions.

Q: How can teams check for potential credential exposure?

Review exception messages generated by ConnectionFactoryConfigurator.load(), especially where exceptions are retained in logs or monitoring systems. The advisory identifies plaintext broker credentials being included in such exception messages.

Q: What remediation is identified?

Red Hat Lightwell released com.rabbitmq:amqp-client 5.25.0.rhlw-00028 with backported fixes for the listed CVEs. No alternative mitigation is specified in the advisory data.

Published Nov 6, 2026

Updated

Red Hat Lightwell has released com.rabbitmq:amqp-client 5.25.0.rhlw-00028 with backported fixes for CVE-2026-106121, CVE-2026-106122, CVE-2026-106123, CVE-2026-61634, CVE-2026-63335, CVE-2026-63336, CVE-2026-63337, CVE-2026-69219, and CVE-2026-69220.

CVE-2026-106121: RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

CVE-2026-106122: RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

CVE-2026-106123: RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

CVE-2026-61634: RabbitMQ Java client accepts broker frames larger than the negotiated AMQP framemax

CVE-2026-63335: RabbitMQ Java client malformed body frame triggers raw command assembler exception

CVE-2026-63336: RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

CVE-2026-63337: RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

CVE-2026-69219: RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

CVE-2026-69220: RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

This patched artifact is a drop-in replacement for com.rabbitmq:amqp-client 5.25.0 from Maven Central.

Affected Software

1 affected componentFixes available

red-hat-lightwell/com.rabbitmq:amqp-client<5.25.0.rhlw-00028

5.25.0.rhlw-00028

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade red-hat-lightwell/com.rabbitmq:amqp-client to a version that resolves this vulnerability.
Fixed in 5.25.0.rhlw-00028
Upgrade
Upgrade com.rabbitmq:amqp-client to a version that resolves this vulnerability.
Fixed in 5.25.0.rhlw-00028

Event History

Nov 6, 2026

Advisory Published

via OSV·07:10 AM

Data Sourced

via OSV·07:10 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which application paths are most relevant when assessing exposure?

Applications using the Java client's JSON-RPC functionality are relevant to the truncated-input denial of service, malformed UTF-8 RPC-consumer failure, and unvalidated class loading issues. Applications that process broker frames are relevant to the oversized-frame, malformed-body-frame, and oversized LongString or bytes allocation issues.

Does TLS use require special attention?

Yes. The advisory states that TrustEverythingTrustManager is used by default by useSslProtocol(), which can enable a man-in-the-middle attack. Review applications that call useSslProtocol() and their TLS trust configuration.

What does an attacker need to target the broker-frame issues?

The affected client must process malicious or malformed broker frames, including frames larger than the negotiated AMQP frame_max, malformed body frames, or oversized LongString or bytes lengths. The stated impacts include exceptions and unchecked allocation that can cause out-of-memory conditions.

How can teams check for potential credential exposure?

Review exception messages generated by ConnectionFactoryConfigurator.load(), especially where exceptions are retained in logs or monitoring systems. The advisory identifies plaintext broker credentials being included in such exception messages.

What remediation is identified?

Red Hat Lightwell released com.rabbitmq:amqp-client 5.25.0.rhlw-00028 with backported fixes for the listed CVEs. No alternative mitigation is specified in the advisory data.

RHLW-2026-45242cd5d8021673: Lightwell Security Advisory: amqp-client 5.25.0.rhlw-00028

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which application paths are most relevant when assessing exposure?

Does TLS use require special attention?

What does an attacker need to target the broker-frame issues?

How can teams check for potential credential exposure?

What remediation is identified?

Company

Resources

Contact

Frequently Asked Questions

Which application paths are most relevant when assessing exposure?

Does TLS use require special attention?

What does an attacker need to target the broker-frame issues?

How can teams check for potential credential exposure?

What remediation is identified?