{"id":"CVE-2026-106122","summary":"RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers","details":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by ValueWriter.writeShortstr. An attacker who can submit an RPC message with a malformed echoed property can cause reply publication in RpcServer.mainloop() or tutorial-style consumers to throw an unchecked exception before acknowledgement. The broker requeues the message, allowing the same message to disable replacement consumers until the queue is purged. This issue is fixed in version 5.36.0.","aliases":["GHSA-7822-rcf6-97fx"],"modified":"2026-10-08T07:12:57.994553456Z","published":"2026-10-06T18:10:18.748Z","database_specific":{"cwe_ids":["CWE-172","CWE-248"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106122.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.36.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106122.json"},{"type":"ADVISORY","url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-7822-rcf6-97fx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106122"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b8bd750fa8c90690e859b18d6343b34421309020"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2065"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rabbitmq/rabbitmq-java-client","events":[{"introduced":"0"},{"fixed":"b8bd750fa8c90690e859b18d6343b34421309020"},{"fixed":"e55ee017a16a0e86b128323a7a9e2211e124f1a2"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"5.36.0"}]}}],"versions":["v5.35.0","v5.34.0","v5.33.1","v5.33.0","v5.32.0","v5.31.0","v5.30.0","v5.29.0","v5.28.0","v5.27.1","v5.27.0","v5.26.0","v5.25.0","v5.24.0","v5.23.0","v5.22.0","v5.21.0","v5.20.0","v5.19.0","v5.17.0","v5.18.0","v5.17.0.RC2","v5.17.0.RC1","v5.16.0","v5.16.0.RC1","v5.15.0","v5.15.0.RC1","v5.14.0","v5.14.0.RC1","v5.13.0","v5.13.0.RC2","v5.13.0.RC1","v5.12.0","v5.12.0.RC1","v5.11.0.RC1","v5.10.0","v5.10.0.RC2","v5.10.0.RC1","v5.9.0","v5.9.0.RC1","v5.8.0","v5.8.0.RC2","v5.8.0.RC1","v5.7.0","v5.7.0.RC1","v5.6.0","v5.6.0.RC1","v5.5.0","v5.5.0.RC1","v5.4.0","v5.4.0.RC3","v5.4.0.RC2","v5.4.0.RC1","v5.4.0.M1","v5.2.0","v5.2.0.RC1","v5.1.0","v5.1.0.RC1","v5.0.0","v5.0.0.RC1","rabbitmq_v3_7_0_milestone15","rabbitmq_v3_7_0_milestone14","rabbitmq_v3_7_0_milestone13","v4.1.0","v4.1.0.RC1","rabbitmq_v3_7_0_milestone12","rabbitmq_v3_7_0_milestone11","rabbitmq_v3_7_0_milestone10","rabbitmq_v3_7_0_milestone9","rabbitmq_v3_7_0_milestone8","v4.0.0","v4.0.0.RC2","rabbitmq_v3_7_0_milestone7","v4.0.0.RC1","v4.0.0.M2","v4.0.0.M1","rabbitmq_v3_7_0_milestone5","rabbitmq_v3_7_0_milestone4","rabbitmq_v3_7_0_milestone3","rabbitmq_v3_7_0_milestone2","rabbitmq_v3_7_0_milestone1","rabbitmq_v3_6_0","rabbitmq_v3_6_0_rc3","rabbitmq_v3_6_0_rc2","rabbitmq_v3_6_0_rc1","rabbitmq_v3_6_0_milestone3","rabbitmq_v3_6_0_milestone2","rabbitmq_v3_6_0_milestone1","rabbitmq_v3_5_0","rabbitmq_v3_4_4","rabbitmq_v3_4_3","rabbitmq_v3_4_2","rabbitmq_v3_4_1","rabbitmq_v2_7_0","rabbitmq_v2_4_0","rabbitmq_v1_8_1","rabbitmq_v1_8_0","rabbitmq_v1_7_2","rabbitmq_v1_7_1","rabbitmq_v1_7_0","rabbitmq_v1_6_0","rabbitmq_v1_4_0"],"database_specific":{"vanir_signatures_modified":"2026-10-08T07:12:57Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106122.json","vanir_signatures":[{"id":"CVE-2026-106122-165f36ae","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b8bd750fa8c90690e859b18d6343b34421309020","target":{"file":"src/main/java/com/rabbitmq/client/RpcServer.java"},"deprecated":false,"digest":{"line_hashes":["224244465907479465845726091376320750420","73043268777816288560584989388841934799","295816795468238447495399972840720726127","155122611622738059723695946398226901540","5257721171260421824756282795760006845","50717403448371636637713388752202321274","324112265155119911487587180957895550298","17283368820325721808562651462293813090","97304931297238603454109479761364197412","44617673253839202034353288307278610648","121233088025295624128042141962727387976"],"threshold":0.9}},{"source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b8bd750fa8c90690e859b18d6343b34421309020","target":{"file":"src/test/java/com/rabbitmq/client/test/RpcTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["133971747853571479398586424940099460251","37744689744893567827309294249531236913","168823982693901124140886584077599799122"]},"id":"CVE-2026-106122-2b860f9f","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"201798133805242415048635654057195464476","length":186},"id":"CVE-2026-106122-4e834e55","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b8bd750fa8c90690e859b18d6343b34421309020","target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java","function":"readShortstr"}},{"id":"CVE-2026-106122-ab00b272","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b8bd750fa8c90690e859b18d6343b34421309020","target":{"file":"src/main/java/com/rabbitmq/client/impl/ValueReader.java"},"deprecated":false,"digest":{"line_hashes":["92330275336458754359238631837330800199","160423910808124418121695895388183436359","110009849424383205426499070363126142479","253148757824100873329332720674069951327","190473804167479299830392486159463516700","38433809622007466363646437228709385087","300268191979738912439186082585175394447"],"threshold":0.9}},{"digest":{"function_hash":"200890104944805190895597253885237506241","length":386},"id":"CVE-2026-106122-ad73ffcd","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b8bd750fa8c90690e859b18d6343b34421309020","target":{"file":"src/main/java/com/rabbitmq/client/RpcServer.java","function":"mainloop"},"deprecated":false},{"target":{"file":"src/test/java/com/rabbitmq/client/test/ClientTestSuite.java"},"deprecated":false,"digest":{"line_hashes":["278329475332812156561864267883179717738","246946218173186421141919625300405363557","225475088853978771300078461815135453039","156433900108454969917184331129534919617"],"threshold":0.9},"id":"CVE-2026-106122-d594d320","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/b8bd750fa8c90690e859b18d6343b34421309020"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}