CVE-2026-106123: falha de média gravidade em com.rabbitmq amqp-client
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
Publicada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.7epss 0.1%
probabilidade de exploração
0.1%top 97% das CVEs
exploração observada
nãonenhuma fonte reporta
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVEs relacionadas — com.rabbitmq amqp-client
No mesmo produto, das mais perigosas para as menos.
CVE-2023-46120MEDIUMRabbitMQ Java client's lack of message size limitation leads to remote DoS attackEPSS 1.1%CVE-2026-69220HIGHRabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoSEPSS 0.7%CVE-2026-69219HIGHRabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocationEPSS 0.7%CVE-2026-63337HIGHRabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loadingEPSS 0.6%CVE-2026-75516HIGHRabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcementEPSS 0.6%CVE-2026-63335MEDIUMRabbitMQ Java client malformed body frame triggers raw command assembler exceptionEPSS 0.5%
Referências
https://github.com/rabbitmq/rabbitmq-java-client/commit/daca1875cdb8b8c0acce78f71103b21a05478446https://github.com/rabbitmq/rabbitmq-java-client/pull/2052https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.35.0https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-h6w7-qmcm-q6xr