CVE-2026-106121

Katalog CVE

CVSS 7.5 · High EPSS 0,50%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada vmware rabbitmq java client. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.

Rincian

Terbit di NVD

6 Oktober 2026

Terakhir diubah

9 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 41,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-cqgh-8p3p-mx4m exploit · advisory vendor
• https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41 patch
• https://github.com/rabbitmq/rabbitmq-java-client/pull/2100 patch
• https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.37.0 release notes