RabbitMQ Java Client up to 5.32.x TLS Configuration certificate validation

Summaryinfo

A vulnerability classified as problematic was found in RabbitMQ Java Client up to 5.32.x. Affected by this issue is the function com.rabbitmq.client.ConnectionFactory.useSslProtocol of the component TLS Configuration. Such manipulation leads to certificate validation. This vulnerability is uniquely identified as CVE-2026-63336. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in RabbitMQ Java Client up to 5.32.x. It has been rated as problematic. Affected by this issue is the function com.rabbitmq.client.ConnectionFactory.useSslProtocol of the component TLS Configuration. The manipulation with an unknown input leads to a certificate validation vulnerability. Using CWE to declare the problem leads to CWE-295. The product does not validate, or incorrectly validates, a certificate. Impacted is integrity. CVE summarizes:

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) configure com.rabbitmq.client.TrustEverythingTrustManager and leave hostname verification disabled, causing arbitrary server certificates, including self-signed certificates, to be accepted. A network attacker able to intercept a TLS connection can impersonate the RabbitMQ broker, read protected AMQP traffic, and modify traffic without certificate or hostname validation. The fix changes the production TLS helpers to use the JVM default trust store and enables hostname verification, while retaining an explicitly named development-only no-verification helper. This issue is fixed in version 5.33.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-63336 since 07/16/2026. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1587.003.

The vulnerability scanner Nessus provides a plugin with the ID 338046 (Linux Distros Unpatched Vulnerability : CVE-2026-63336), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 5.33.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (338046). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Language Software

Vendor

• RabbitMQ

Name

• Java Client

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 5.8
• 5.9
• 5.10
• 5.11
• 5.12
• 5.13
• 5.14
• 5.15
• 5.16
• 5.17
• 5.18
• 5.19
• 5.20
• 5.21
• 5.22
• 5.23
• 5.24
• 5.25
• 5.26
• 5.27
• 5.28
• 5.29
• 5.30
• 5.31
• 5.32

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion