{"id":"CVE-2026-106121","revision":"159f3ad052c74c3aa9a1ad9f049ff9f4","records":[{"revision":"159f3ad052c74c3aa9a1ad9f049ff9f4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-106121","aliases":[],"title":"RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS","description":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.","state":0,"publishedAt":"2026-10-06T18:08:52.026+00:00","modifiedAt":"2026-10-06T18:32:46.845+00:00","affected":[{"ecosystem":"Vendor product","name":"rabbitmq-java-client","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"rabbitmq\",\n                    \"product\": \"rabbitmq-java-client\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 5.36.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"amqp-client","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"com.rabbitmq\",\n                    \"product\": \"amqp-client\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 5.36.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","score":4.9,"severity":"MEDIUM"}],"references":["https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-cqgh-8p3p-mx4m","https://github.com/rabbitmq/rabbitmq-java-client/pull/2100","https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41","https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.37.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106121","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-106121","identifiers":["CVE-2026-106121"]},"retained":false,"historicalAffected":[]}],"coverage":[]}