CVE-2026-106122
Description
A flaw was found in the RabbitMQ Java client library. A remote attacker capable of submitting Remote Procedure Call (RPC) messages with malformed UTF-8 character sequences can cause a Denial of Service (DoS). When the client library decodes and re-encodes an invalid property string, it exceeds internal protocol size limits and throws an unhandled exception before acknowledging the message. As a result, the message broker repeatedly requeues the malformed message, repeatedly crashing consuming applications and halting message queue operations.
Statement
A denial-of-service flaw of moderate impact was found in the RabbitMQ Java client library (com.rabbitmq:amqp-client), which is used by Red Hat JBoss Fuse and the Red Hat build of Apache Camel for Quarkus. The client decodes malformed UTF-8 bytes in AMQP shortstr properties (for example correlation-id) into U+FFFD replacement characters. When a consumer echoes such a property back, as the documented RPC pattern does, the re-encoded string can exceed the AMQP shortstr size limit, and the client throws an unchecked exception before the message is acknowledged. The broker requeues the unacknowledged message, so a single malicious RPC message can repeatedly crash or permanently disable consumer applications until the affected queue is purged. An authenticated remote attacker able to publish messages to the broker can use this flaw to halt message queue operations.
Red Hat rates this flaw as MODERATE severity (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires an authenticated client permitted to publish to the affected queues, whereas NIST scores it 7.5 by assuming no privileges are required. The affected Red Hat JBoss Fuse stream is out of support scope, so no fix is planned for it. For the Red Hat build of Apache Camel for Quarkus, the fix is deferred because this moderate-impact flaw has a CVSS score below 7.0; the residual risk is denial of service of RPC-style consumers by an authenticated message publisher.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream project addressed this issue in version 5.36.0 of the RabbitMQ Java client (com.rabbitmq:amqp-client); no Red Hat fixed packages are currently available for the affected products.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Read Application Data
An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information, or other unintended behaviors.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
