CVE-2026-106121Published
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-106121 · Microsoft / collected KEV context
cve-program · CVE-2026-106121
- https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-cqgh-8p3p-mx4m
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2100
- https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41
- https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.37.0
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.