CVE-2026-106123: fallo de gravedad media en com.rabbitmq amqp-client
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
Publicada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.7epss 0.1%
probabilidad de explotación
0.1%top 97% de las CVE
explotación observada
noninguna fuente lo reporta
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVEs relacionadas — com.rabbitmq amqp-client
En el mismo producto, de las más peligrosas a las menos.
CVE-2023-46120MEDIUMRabbitMQ Java client's lack of message size limitation leads to remote DoS attackEPSS 1.1%CVE-2026-69220HIGHRabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoSEPSS 0.7%CVE-2026-69219HIGHRabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocationEPSS 0.7%CVE-2026-63337HIGHRabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loadingEPSS 0.6%CVE-2026-75516HIGHRabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcementEPSS 0.6%CVE-2026-63335MEDIUMRabbitMQ Java client malformed body frame triggers raw command assembler exceptionEPSS 0.5%
Referencias
https://github.com/rabbitmq/rabbitmq-java-client/commit/daca1875cdb8b8c0acce78f71103b21a05478446https://github.com/rabbitmq/rabbitmq-java-client/pull/2052https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.35.0https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-h6w7-qmcm-q6xr