RHLW-2026-f4441c6bf0c89319: Lightwell Security Advisory: amqp-client 5.30.0.rhlw-00016
Red Hat Lightwell has released com.rabbitmq:amqp-client 5.30.0.rhlw-00016 with backported fixes for CVE-2026-106121, CVE-2026-106122, CVE-2026-106123, CVE-2026-61634, CVE-2026-63335, CVE-2026-63336, CVE-2026-63337, CVE-2026-69219, and CVE-2026-69220.
CVE-2026-106121: RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
CVE-2026-106122: RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers
CVE-2026-106123: RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
CVE-2026-61634: RabbitMQ Java client accepts broker frames larger than the negotiated AMQP framemax
CVE-2026-63335: RabbitMQ Java client malformed body frame triggers raw command assembler exception
CVE-2026-63336: RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
CVE-2026-63337: RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
CVE-2026-69219: RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation
CVE-2026-69220: RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS
This patched artifact is a drop-in replacement for com.rabbitmq:amqp-client 5.30.0 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/com.rabbitmq:amqp-clientto a version that resolves this vulnerability.Fixed in 5.30.0.rhlw-00016 - Upgrade
Upgrade
com.rabbitmq:amqp-clientto a version that resolves this vulnerability.Fixed in 5.30.0.rhlw-00016
Event History
Child vulnerabilities
Contains the following vulnerabilities.
- CVE-2026-106121
- CVE-2026-106122
- CVE-2026-106123
- CVE-2026-61634
- CVE-2026-63335
- CVE-2026-63336
- CVE-2026-63337
- CVE-2026-69219
- CVE-2026-69220
- GHSA-5m9f-rphj-c435
- GHSA-5xwg-cfvj-gff5
- GHSA-68mj-5wr7-6fgg
- GHSA-6g32-pxv4-2wfj
- GHSA-7822-rcf6-97fx
- GHSA-93j5-89vc-pph4
- GHSA-cqgh-8p3p-mx4m
- GHSA-h6w7-qmcm-q6xr
- GHSA-qx7j-jv8m-fppr
Frequently Asked Questions
Which of the listed issues can expose broker credentials?
CVE-2026-106123 can leak plaintext broker credentials in an exception message produced by ConnectionFactoryConfigurator.load().
Are any default client behaviors implicated?
Yes. CVE-2026-106121 affects the default JSON-RPC mapper when it receives truncated input. CVE-2026-63336 states that useSslProtocol() uses TrustEverythingTrustManager by default, enabling a man-in-the-middle risk.
What malformed broker data can cause client availability problems?
The advisory lists malformed UTF-8 in shortstr properties that can permanently disable RPC consumers (CVE-2026-106122), broker frames exceeding the negotiated AMQP frame_max (CVE-2026-61634), malformed body frames (CVE-2026-63335), and oversized LongString or bytes lengths that can trigger out-of-memory allocation (CVE-2026-69219).
Is arbitrary class loading among the addressed risks?
Yes. CVE-2026-63337 involves unvalidated Class.forName use in JSON-RPC ProcedureDescription, enabling arbitrary class loading.