CVE-2026-106121

A MODERATE severity denial of service flaw was found in the RabbitMQ Java client library (com.rabbitmq/amqp-client), which is included in Red Hat JBoss Fuse and Red Hat build of Apache Camel. The built-in JSON parser com.rabbitmq.tools.json.JSONReader.read() does not terminate when its input ends inside an unterminated quoted string or a // line comment, because its string and whitespace scanners do not stop at CharacterIterator.DONE. When the default DefaultJsonRpcMapper passes such a truncated JSON-RPC message body to the parser, an unterminated string causes unbounded memory allocation that exhausts the JVM heap (OutOfMemoryError), while an unterminated line comment pins a thread consuming CPU indefinitely. A remote attacker able to publish a specially crafted, truncated message to a JSON-RPC request queue, or a malicious JSON-RPC service replying to a client, can render the affected JVM application unresponsive. Only applications that use the JSON-RPC-over-AMQP tooling (com.rabbitmq.tools.jsonrpc) with the default mapper are affected. Red Hat rates this flaw MODERATE (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); the higher NIST score of 7.5 (IMPORTANT) differs mainly in Privileges Required, as exploitation generally requires an attacker with credentials sufficient to publish messages to the target queue. In Red Hat build of Apache Camel (rhboac-camel-quarkus-3), the fix is deferred because Red Hat does not file trackers for MODERATE severity flaws with a CVSS score below 7.0; the residual risk is continued exposure to remote denial of service in applications that use the JSON-RPC tooling with the default mapper. The Red Hat JBoss Fuse fuse-7-els-2 affect is out of support scope and will not receive a fix.