CVE-2026-106121 in Java Client
Summary
by MITRE • 10/06/2026
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The RabbitMQ Java client library serves as a critical component for enabling Java and JVM-based applications to establish connections with and interact effectively with RabbitMQ message broker nodes. Within this ecosystem, the handling of JSON-RPC messages relies on specific parsing mechanisms that are susceptible to resource exhaustion vulnerabilities when processing malformed or truncated input data. Specifically, prior to version 5.37.0, the com.rabbitmq.tools.json.JSONReader.read() method exhibited a critical flaw in its string and whitespace scanning logic. This implementation failed to properly recognize the end of an input stream indicated by CharacterIterator.DONE, leading to catastrophic failures when processing incomplete JSON structures or improperly terminated comments.
The technical root cause lies in the failure of the internal scanners to terminate their operations upon reaching the end of the provided character iterator. When a truncated string is encountered, where the closing quotation mark is missing, the parser does not halt but instead attempts to continue reading beyond the available data boundaries. To compensate for this perceived incomplete state, the implementation appends replacement end markers indefinitely until the Java heap space is completely exhausted. This behavior directly triggers an OutOfMemoryError, effectively crashing the application thread responsible for processing the message and disrupting service availability.
In scenarios involving line comments that lack a terminating newline character, the vulnerability manifests differently but with equally severe consequences. The scanner enters an infinite loop attempting to locate the expected end-of-line marker within the input stream. Since no such marker exists in truncated or malformed inputs, the associated thread consumes CPU resources indefinitely without making progress. This results in a classic denial of service condition where application threads are blocked permanently, preventing further message processing and degrading the overall performance and reliability of the RabbitMQ client infrastructure.
From a security classification perspective, this vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, specifically manifesting as both memory exhaustion via heap allocation and CPU starvation through infinite looping. In terms of attack vectors, these conditions can be exploited by an attacker sending specially crafted JSON-RPC messages to the JsonRpcServer or expecting replies from a client implementation that utilizes this flawed parser. This falls under MITRE ATT&CK technique T1499, Endpoint Denial of Service, as it allows for the disruption of service availability through resource exhaustion rather than direct system compromise.
The operational impact of these flaws is significant for any production environment relying on JSON-RPC communication over RabbitMQ channels. An attacker with the ability to inject or manipulate message payloads can trigger either memory leaks leading to application crashes or CPU saturation causing thread hangs. This disrupts messaging flows, causes data loss if messages are not properly acknowledged before failure, and requires manual intervention such as service restarts to restore normal operations. The vulnerability affects both server-side processing of incoming JSON-RPC requests and client-side handling of replies that may be truncated during network interruptions or malicious manipulation.
This issue has been addressed in version 5.37.0 of the RabbitMQ Java client library through corrections to the string and whitespace scanning logic within the JSONReader class. The fix ensures proper termination conditions are met when CharacterIterator.DONE is encountered, preventing both infinite loops and unbounded memory allocation. Organizations utilizing this library should prioritize upgrading to version 5.37.0 or later to mitigate these denial of service risks. Additionally, implementing input validation layers at network boundaries can provide defense-in-depth by rejecting malformed JSON structures before they reach the vulnerable parser components.