{"id":"CVE-2026-63336","summary":"RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM","details":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) configure com.rabbitmq.client.TrustEverythingTrustManager and leave hostname verification disabled, causing arbitrary server certificates, including self-signed certificates, to be accepted. A network attacker able to intercept a TLS connection can impersonate the RabbitMQ broker, read protected AMQP traffic, and modify traffic without certificate or hostname validation. The fix changes the production TLS helpers to use the JVM default trust store and enables hostname verification, while retaining an explicitly named development-only no-verification helper. This issue is fixed in version 5.33.0.","aliases":["GHSA-5m9f-rphj-c435"],"modified":"2026-08-20T10:17:18.771784Z","published":"2026-08-18T16:29:23.115Z","related":["CGA-mx55-r6rf-78jw"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-295"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63336.json"},"references":[{"type":"WEB","url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63336.json"},{"type":"ADVISORY","url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63336"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/1999"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2001"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rabbitmq/rabbitmq-java-client","events":[{"introduced":"0"},{"fixed":"1e7deb2e6020c9793a81385a53ea378ec63b9339"},{"fixed":"a4bf571dd368765baaa9cecfae68ce09f1bdcc01"},{"fixed":"a6ff07ecf96c1f001d611ea9b88ed8b6e045aa61"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.33.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v5.32.0","v5.31.0","v5.30.0","v5.29.0","v5.28.0","v5.27.1","v5.27.0","v5.26.0","v5.25.0","v5.24.0","v5.23.0","v5.22.0","v5.21.0","v5.20.0","v5.19.0","v5.17.0","v5.18.0","v5.17.0.RC2","v5.17.0.RC1","v5.16.0","v5.16.0.RC1","v5.15.0","v5.15.0.RC1","v5.14.0","v5.14.0.RC1","v5.13.0","v5.13.0.RC2","v5.13.0.RC1","v5.12.0","v5.12.0.RC1","v5.11.0.RC1","v5.10.0","v5.10.0.RC2","v5.10.0.RC1","v5.9.0","v5.9.0.RC1","v5.8.0","v5.8.0.RC2","v5.8.0.RC1","v5.7.0","v5.7.0.RC1","v5.6.0","v5.6.0.RC1","v5.5.0","v5.5.0.RC1","v5.4.0","v5.4.0.RC3","v5.4.0.RC2","v5.4.0.RC1","v5.4.0.M1","v5.2.0","v5.2.0.RC1","v5.1.0","v5.1.0.RC1","v5.0.0","v5.0.0.RC1","rabbitmq_v3_7_0_milestone15","rabbitmq_v3_7_0_milestone14","rabbitmq_v3_7_0_milestone13","v4.1.0","v4.1.0.RC1","rabbitmq_v3_7_0_milestone12","rabbitmq_v3_7_0_milestone11","rabbitmq_v3_7_0_milestone10","rabbitmq_v3_7_0_milestone9","rabbitmq_v3_7_0_milestone8","v4.0.0","v4.0.0.RC2","rabbitmq_v3_7_0_milestone7","v4.0.0.RC1","v4.0.0.M2","v4.0.0.M1","rabbitmq_v3_7_0_milestone5","rabbitmq_v3_7_0_milestone4","rabbitmq_v3_7_0_milestone3","rabbitmq_v3_7_0_milestone2","rabbitmq_v3_7_0_milestone1","rabbitmq_v3_6_0","rabbitmq_v3_6_0_rc3","rabbitmq_v3_6_0_rc2","rabbitmq_v3_6_0_rc1","rabbitmq_v3_6_0_milestone3","rabbitmq_v3_6_0_milestone2","rabbitmq_v3_6_0_milestone1","rabbitmq_v3_5_0","rabbitmq_v3_4_4","rabbitmq_v3_4_3","rabbitmq_v3_4_2","rabbitmq_v3_4_1","rabbitmq_v2_7_0","rabbitmq_v2_4_0","rabbitmq_v1_8_1","rabbitmq_v1_8_0","rabbitmq_v1_7_2","rabbitmq_v1_7_1","rabbitmq_v1_7_0","rabbitmq_v1_6_0","rabbitmq_v1_4_0"],"database_specific":{"vanir_signatures_modified":"2026-08-20T10:17:18Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["168979995764584744562417397919321217744","196716252027747449651876626506480880074","155686288704506230079830407715717293826","30133597617809903680108232072422017494","268215389722916780072752905709993071595","74897144638303172143377260114233133730","75674513549008345745458735410951633611","269969744956080303157258875237745063017","295963721074074444263988785813470121679","104161098509569930911364626191382860953","227043199079312795542475649751132491701","259672845391683558758975096167245929802","324503502180949105053902988499236092771","325077685349998985511536925530241131201","66937583460008798987366756774350133756","240825584590420358204673936179546020049","267846513233585823567385669460010613602","87600714655447867836485771032940608041","115849544461992304478605598534274814468","181351760398135195667537938927785680603","167312125226792213352354874988637235135","262085610903102167348924859466311014430","309866934699462367732674824092759746980","215026652962870426316111175271463935423","99754883238676425973778019399032490070","324387027090532871368562186120862171212","331161478421318964708559645054127831809","164048042311940888477897763239717843091","70741116707457926747173800286354008001","312126131605166351327399218753257712893","80914445672816302925368556731078788460","115655771775053176414768386981395118505","18238823339488075164135387839606488317","43194752555268170249277171516765768649","11890295267026158665389104052807561362","223974325191646893343560505796438218473","199962675250714799893460467700494417915","284510163054894644447223894105925815145","119069772968267665457739472104582925089","333704430467233554987329486581988624300","321479902473110615900651046946096087702","98884817270275220299904222127950520556","40237099462235442398039627258834418192","139955791929361527826404543152895015697","165844949304758906571054631948005104196","26747466452359817199551093998696730418"],"threshold":0.9},"id":"CVE-2026-63336-002516d9","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactory.java"}},{"id":"CVE-2026-63336-03742223","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactory.java","function":"setUri"},"deprecated":false,"digest":{"function_hash":"320539407962254391730378023612080007073","length":1334}},{"id":"CVE-2026-63336-05f0e834","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"function":"useSslProtocol","file":"src/main/java/com/rabbitmq/client/ConnectionFactory.java"},"deprecated":false,"digest":{"length":138,"function_hash":"306085259070640051139721585351161740669"}},{"source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/test/java/com/rabbitmq/client/test/PropertyFileInitialisationTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["90484664931189257701165957865648992432","193357916035530497610420449686718917394","282158944090750535375698325575178173172","233881533121608703456160766049456591478","97965405225402006962548009978421845847","90228762349292352719157689295100925713","4618259118183583966923360192290113599","4047959038684628401591404966950964460","109914869058755937396782388907862920189","183782197301045519836151857127600082420","220797478758594970439380951962361517397","265741973047258463303751545178866356899","234070325894189494606587037441626983472"]},"id":"CVE-2026-63336-08130460","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["30780898820543281476074291661983230845","225204721544854415109724570451928698586","94327308961430611525608374110145783263","110491900802461944355823331468307380820","68248078748215698676616498180400791417","122916228854712683305804946083936120196"],"threshold":0.9},"id":"CVE-2026-63336-11bd1e4f","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactoryConfigurator.java"},"deprecated":false},{"source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"function":"dev","file":"src/main/java/com/rabbitmq/client/impl/OAuth2ClientCredentialsGrantCredentialsProvider.java"},"deprecated":false,"digest":{"function_hash":"289565859946005399967297407016122745506","length":395},"id":"CVE-2026-63336-1828d518","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-63336-2188c8e1","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/test/java/com/rabbitmq/client/test/ssl/UnverifiedConnection.java","function":"openConnection"},"deprecated":false,"digest":{"function_hash":"334525032713193164572175444653195668064","length":566}},{"deprecated":false,"digest":{"function_hash":"270723539646576677207714545118054527402","length":131},"id":"CVE-2026-63336-27c96a65","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactory.java","function":"useSslProtocol"}},{"id":"CVE-2026-63336-28bc20a6","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"function":"useSslProtocol","file":"src/main/java/com/rabbitmq/client/ConnectionFactory.java"},"deprecated":false,"digest":{"function_hash":"21481122202273822903450180226200242898","length":113}},{"id":"CVE-2026-63336-2f9f8351","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/test/java/com/rabbitmq/client/test/ssl/UnverifiedConnection.java","function":"openConnection"},"deprecated":false,"digest":{"function_hash":"334525032713193164572175444653195668064","length":566}},{"target":{"file":"src/main/java/com/rabbitmq/client/TrustEverythingTrustManager.java","function":"TrustEverythingTrustManager"},"deprecated":false,"digest":{"length":384,"function_hash":"293193402549720164039475291339625370814"},"id":"CVE-2026-63336-32c2c812","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01"},{"signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactoryConfigurator.java"},"deprecated":false,"digest":{"line_hashes":["30780898820543281476074291661983230845","225204721544854415109724570451928698586","94327308961430611525608374110145783263","110491900802461944355823331468307380820","68248078748215698676616498180400791417","122916228854712683305804946083936120196"],"threshold":0.9},"id":"CVE-2026-63336-33c8f1d5","signature_type":"Line"},{"target":{"file":"src/main/java/com/rabbitmq/client/TrustEverythingTrustManager.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["270102349117348233721019512806448196350","315410133681949242914005673122197134738","169440936063490890721466622751958584098","256436782465186125773762964825492599630","101547193577864826438860289956717583969","286661445737032200579301406834682653624","153762853220149088796427697652748255945","119117468659796633423721686101063433528","260384449642925297174134710776702357496","250806773215990572292328010278451155280","185504439330432749741055964152002311593","30612284237086438781824515411067106276","221845436929449551240485707463655273004","47506802184620379790824699344313516621","126609212762948362314747319669100508584","41571337265045681857493626034446932284","62976738351542488492571112077115759050","106127978058951534849524474406758067585"]},"id":"CVE-2026-63336-39d832b2","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339"},{"target":{"file":"src/main/java/com/rabbitmq/client/TrustEverythingTrustManager.java","function":"TrustEverythingTrustManager"},"deprecated":false,"digest":{"length":384,"function_hash":"293193402549720164039475291339625370814"},"id":"CVE-2026-63336-3bc18e81","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339"},{"signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactory.java","function":"useSslProtocol"},"deprecated":false,"digest":{"function_hash":"62534680892484336035205200275362953646","length":170},"id":"CVE-2026-63336-466d726f","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"324426648174676661539994041893553543187","length":491},"id":"CVE-2026-63336-54ded684","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/test/java/com/rabbitmq/client/test/PropertyFileInitialisationTest.java","function":"tlsBasicSetupShouldTrustEveryoneWhenServerValidationIsNotEnabled"}},{"signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactory.java"},"deprecated":false,"digest":{"line_hashes":["168979995764584744562417397919321217744","196716252027747449651876626506480880074","155686288704506230079830407715717293826","30133597617809903680108232072422017494","268215389722916780072752905709993071595","74897144638303172143377260114233133730","75674513549008345745458735410951633611","269969744956080303157258875237745063017","295963721074074444263988785813470121679","104161098509569930911364626191382860953","113717252637142133019383653704847693160","90981623750267344786102908462950979214","314506998495403757129541025607525881208","288426003423563867547419354288591588427","268234377124735613697276396199052635978","202031621224993014253496591310774353637","28839401860373661247887779472993881063","181351760398135195667537938927785680603","280733734653560865908217941795712943598","60331396280525932071255790954547745195","304244392560391076241328480684500465661","26850641295626260880599943660679077676","13513035384075146480297541123215937795","221422317543310355615779377674810957469","80871298943749254940046442346853980076","207275537591885989758384382464177140470","138495030045020774309133949061924253064","175615444783913328846143306389422256033","135250323742755792677575084395340992900","34755083013299816936599370771709381298","305448588101084803524870186740732464207","189856041972969537629891847092842262058","89284810352267369763458910122092753324","229559641602925185587595438463484745992","232905820659080580991932198108389374938","263872372048287441583247946466291910651","76348926331759947029943437840296303054","308911300359072603659575562048368646639","44402502570559687883457805138458880918","14451918860034048837106797424173371401","15857183143351390661167383544906222174","200438220990456922981359618783394615663","191011781069164474272016713247044597311","12996696560438919151505372947825159820","302050380548358987333201273783975863701"],"threshold":0.9},"id":"CVE-2026-63336-596476b3","signature_type":"Line"},{"digest":{"line_hashes":["20181337953174923414043753999542779070","134817919607852071108585427094614719337","170145165783308095307611597374327058552","187130932628174619780255886767235974459","336047145497180659330206758571851594431","283083651622046705479121080493698138126","95465184758133457888495379876251180679","217023478419791766895962578257752401884"],"threshold":0.9},"id":"CVE-2026-63336-660a2838","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/test/java/com/rabbitmq/client/test/ConnectionFactoryTest.java"},"deprecated":false},{"id":"CVE-2026-63336-8965d7b2","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactoryConfigurator.java","function":"setUpBasicSsl"},"deprecated":false,"digest":{"function_hash":"52478627483815894596152032891703349147","length":302}},{"digest":{"function_hash":"188136250604559453682289204246208760068","length":57},"id":"CVE-2026-63336-8bf18a04","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactory.java","function":"setSslContextFactory"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/test/java/com/rabbitmq/client/test/ConnectionFactoryTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["288531918126951895722188247071792435842","144961189872669068674815911965263390378","58275338368855943751006833991095274859","111394966048151213580674613295986038920"]},"id":"CVE-2026-63336-9b951a77"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactory.java","function":"useSslProtocol"},"deprecated":false,"digest":{"function_hash":"190452140886520503428900268239183312701","length":163},"id":"CVE-2026-63336-a0a08c48"},{"signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/test/java/com/rabbitmq/client/test/PropertyFileInitialisationTest.java"},"deprecated":false,"digest":{"line_hashes":["90484664931189257701165957865648992432","193357916035530497610420449686718917394","282158944090750535375698325575178173172","233881533121608703456160766049456591478","97965405225402006962548009978421845847","90228762349292352719157689295100925713","4618259118183583966923360192290113599","4047959038684628401591404966950964460","109914869058755937396782388907862920189","183782197301045519836151857127600082420","220797478758594970439380951962361517397","265741973047258463303751545178866356899","234070325894189494606587037441626983472"],"threshold":0.9},"id":"CVE-2026-63336-ad90dc97","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/test/java/com/rabbitmq/client/test/ssl/TlsTestUtils.java"},"deprecated":false,"digest":{"line_hashes":["91542434615022032111845748697437175453","316243734944457178409991989501569309969","141060722822862922464986531849455428080","144508430856973750880463232791897557776","201570312069269953766345587095336582889","237298165449109485160241777778175812052","305032435649671499342084857799910413024","325096716085421781503441164037143979941","294342987913758076504383369094260901447","231753990610074578483697352909668317769","10068567365230016225817448285771646224"],"threshold":0.9},"id":"CVE-2026-63336-af8d7a7d"},{"source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/main/java/com/rabbitmq/client/impl/OAuth2ClientCredentialsGrantCredentialsProvider.java"},"deprecated":false,"digest":{"line_hashes":["111384118199522133789770550729121429162","250327614326131528203699189452865449575","317159550500097031914895634368634755016","232374589722050909610964371664824255485","297170584073306612504191419266114265766","188444493326568066938848282766409417612","51428613461628496909381801084315240750","44533511727495533045688565960437041864","189459979367660495656277417384090894954","196723859275743364269447607469027731463","249467750375913060954393068192594042919","315357385880608665899429509701177744746","232012931770829961500954458834272271223","118834471407366973811216028607106114881","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2026-63336-b7f41874","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-63336-b95f376e","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/test/java/com/rabbitmq/client/test/ssl/TlsTestUtils.java"},"deprecated":false,"digest":{"line_hashes":["91542434615022032111845748697437175453","316243734944457178409991989501569309969","141060722822862922464986531849455428080","144508430856973750880463232791897557776","201570312069269953766345587095336582889","237298165449109485160241777778175812052","305032435649671499342084857799910413024","325096716085421781503441164037143979941","294342987913758076504383369094260901447","231753990610074578483697352909668317769","10068567365230016225817448285771646224"],"threshold":0.9}},{"source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactoryConfigurator.java","function":"setUpBasicSsl"},"deprecated":false,"digest":{"function_hash":"52478627483815894596152032891703349147","length":302},"id":"CVE-2026-63336-bd9686e8","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactory.java","function":"ensureUnsignedShort"},"deprecated":false,"digest":{"length":161,"function_hash":"297331823820611025114019610497036624777"},"id":"CVE-2026-63336-c744cec6","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-63336-c9ccaecc","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/main/java/com/rabbitmq/client/impl/OAuth2ClientCredentialsGrantCredentialsProvider.java","function":"dev"},"deprecated":false,"digest":{"function_hash":"289565859946005399967297407016122745506","length":395}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/test/java/com/rabbitmq/client/test/ssl/TlsTestUtils.java","function":"maybeConfigureNetty"},"deprecated":false,"digest":{"function_hash":"177516018585354301322882921303650226990","length":214},"id":"CVE-2026-63336-d8daf8ae"},{"target":{"file":"src/test/java/com/rabbitmq/client/test/ssl/TlsTestUtils.java","function":"maybeConfigureNetty"},"deprecated":false,"digest":{"function_hash":"177516018585354301322882921303650226990","length":214},"id":"CVE-2026-63336-dc16e686","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01"},{"source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/main/java/com/rabbitmq/client/TrustEverythingTrustManager.java"},"deprecated":false,"digest":{"line_hashes":["270102349117348233721019512806448196350","315410133681949242914005673122197134738","169440936063490890721466622751958584098","256436782465186125773762964825492599630","101547193577864826438860289956717583969","286661445737032200579301406834682653624","153762853220149088796427697652748255945","119117468659796633423721686101063433528","260384449642925297174134710776702357496","250806773215990572292328010278451155280","185504439330432749741055964152002311593","30612284237086438781824515411067106276","221845436929449551240485707463655273004","47506802184620379790824699344313516621","126609212762948362314747319669100508584","41571337265045681857493626034446932284","62976738351542488492571112077115759050","106127978058951534849524474406758067585"],"threshold":0.9},"id":"CVE-2026-63336-e0682276","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-63336-e3285306","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/test/java/com/rabbitmq/client/test/PropertyFileInitialisationTest.java","function":"tlsBasicSetupShouldTrustEveryoneWhenServerValidationIsNotEnabled"},"deprecated":false,"digest":{"function_hash":"324426648174676661539994041893553543187","length":491}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/main/java/com/rabbitmq/client/impl/OAuth2ClientCredentialsGrantCredentialsProvider.java"},"deprecated":false,"digest":{"line_hashes":["111384118199522133789770550729121429162","250327614326131528203699189452865449575","317159550500097031914895634368634755016","232374589722050909610964371664824255485","297170584073306612504191419266114265766","188444493326568066938848282766409417612","51428613461628496909381801084315240750","44533511727495533045688565960437041864","189459979367660495656277417384090894954","196723859275743364269447607469027731463","249467750375913060954393068192594042919","315357385880608665899429509701177744746","232012931770829961500954458834272271223","118834471407366973811216028607106114881","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2026-63336-e4468479"},{"deprecated":false,"digest":{"function_hash":"203904501101428940918026864933390729620","length":3203},"id":"CVE-2026-63336-e550d762","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/test/java/com/rabbitmq/client/test/ConnectionFactoryTest.java","function":"shouldBeConfigurableUsingFluentAPI"}},{"id":"CVE-2026-63336-ea775b93","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/test/java/com/rabbitmq/client/test/ssl/UnverifiedConnection.java"},"deprecated":false,"digest":{"line_hashes":["84345488490787016635754024698357763800","169910333670620954783776508046661213474","257846771654201608390971302055334921517","83552851694174744451336902877710148514","323369533137935699961207677929128372774","4929111180033859032112631150162792815","76489989214109555934105944597513462441","163646968317795663787512006856002128136","282322706834821236515692552865578211820","137212217647672790504936118716536895099"],"threshold":0.9}},{"source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01","target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactory.java","function":"useSslProtocol"},"deprecated":false,"digest":{"function_hash":"73012695958996034559682748670861067728","length":127},"id":"CVE-2026-63336-efa8fdef","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-63336-f1209b91","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339","target":{"file":"src/test/java/com/rabbitmq/client/test/ssl/UnverifiedConnection.java"},"deprecated":false,"digest":{"line_hashes":["84345488490787016635754024698357763800","169910333670620954783776508046661213474","257846771654201608390971302055334921517","83552851694174744451336902877710148514","323369533137935699961207677929128372774","4929111180033859032112631150162792815","76489989214109555934105944597513462441","163646968317795663787512006856002128136","282322706834821236515692552865578211820","137212217647672790504936118716536895099"],"threshold":0.9}},{"target":{"file":"src/main/java/com/rabbitmq/client/ConnectionFactory.java","function":"setUri"},"deprecated":false,"digest":{"function_hash":"50133370499350963643452236765915183676","length":1348},"id":"CVE-2026-63336-fc334a79","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63336.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N"}]}