{"id":"CVE-2020-36282","details":"JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.","aliases":["GHSA-v525-c3g5-cg9p"],"modified":"2026-07-08T21:26:11.374450Z","published":"2021-03-12T01:15:12.373Z","references":[{"type":"WEB","url":"https://medium.com/%40ramon93i7/a99645d0448b"},{"type":"ADVISORY","url":"https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2"},{"type":"ADVISORY","url":"https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-jms-client/issues/135"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rabbitmq/rabbitmq-jms-client","events":[{"introduced":"d66e26c7c7f1a350f49548872d6a1c2c6d8abedb"},{"fixed":"df5a7fc2806ce3b2a84f1eee3921036fc700781f"},{"introduced":"6f5e2a79aff3fc249653c75f82240d0ed6e4b8aa"},{"fixed":"a017343d2193fb81fb41334f725d3b277ad9bf0b"}],"database_specific":{"extracted_events":[{"introduced":"1.0.0"},{"fixed":"1.15.2"},{"introduced":"2.0.0"},{"fixed":"2.2.0"}],"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:rabbitmq:jms_client:*:*:*:*:*:rabbitmq:*:*"}}],"versions":["v2.1.1","v2.1.0","v2.1.0.RC1","v2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36282.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}