{"id":"CVE-2026-106121","summary":"RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS","details":"The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.","aliases":["GHSA-cqgh-8p3p-mx4m"],"modified":"2026-10-22T19:09:25.085399704Z","published":"2026-10-06T18:08:52.026Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-835"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106121.json","unresolved_ranges":[{"extracted_events":[{"range":[{"fixed":"5.36.1"},{"fixed":"5.36.1"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"}]}]},"references":[{"type":"WEB","url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.37.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106121.json"},{"type":"ADVISORY","url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-cqgh-8p3p-mx4m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106121"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2100"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rabbitmq/rabbitmq-java-client","events":[{"introduced":"0"},{"fixed":"002777578d9138a9921ddfc4f9fb70556f8d4807"},{"fixed":"25fad817291feff3195c32620117d295598f8b41"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:*","range":[{"introduced":"0"},{"fixed":"5.37.0"}],"source":"CPE_RANGE"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"25fad817291feff3195c32620117d295598f8b41"}]},{"range":[{"fixed":"002777578d9138a9921ddfc4f9fb70556f8d4807"}],"source":"REFERENCES_TAG","original_tag":"v5.37.0"}]}}],"versions":["v5.36.0","v5.35.0","v5.34.0","v5.33.1","v5.33.0","v5.32.0","v5.31.0","v5.30.0","v5.29.0","v5.28.0","v5.27.1","v5.27.0","v5.26.0","v5.25.0","v5.24.0","v5.23.0","v5.22.0","v5.21.0","v5.20.0","v5.19.0","v5.17.0","v5.18.0","v5.17.0.RC2","v5.17.0.RC1","v5.16.0","v5.16.0.RC1","v5.15.0","v5.15.0.RC1","v5.14.0","v5.14.0.RC1","v5.13.0","v5.13.0.RC2","v5.13.0.RC1","v5.12.0","v5.12.0.RC1","v5.11.0.RC1","v5.10.0","v5.10.0.RC2","v5.10.0.RC1","v5.9.0","v5.9.0.RC1","v5.8.0","v5.8.0.RC2","v5.8.0.RC1","v5.7.0","v5.7.0.RC1","v5.6.0","v5.6.0.RC1","v5.5.0","v5.5.0.RC1","v5.4.0","v5.4.0.RC3","v5.4.0.RC2","v5.4.0.RC1","v5.4.0.M1","v5.2.0","v5.2.0.RC1","v5.1.0","v5.1.0.RC1","v5.0.0","v5.0.0.RC1","rabbitmq_v3_7_0_milestone15","rabbitmq_v3_7_0_milestone14","rabbitmq_v3_7_0_milestone13","v4.1.0","v4.1.0.RC1","rabbitmq_v3_7_0_milestone12","rabbitmq_v3_7_0_milestone11","rabbitmq_v3_7_0_milestone10","rabbitmq_v3_7_0_milestone9","rabbitmq_v3_7_0_milestone8","v4.0.0","v4.0.0.RC2","rabbitmq_v3_7_0_milestone7","v4.0.0.RC1","v4.0.0.M2","v4.0.0.M1","rabbitmq_v3_7_0_milestone5","rabbitmq_v3_7_0_milestone4","rabbitmq_v3_7_0_milestone3","rabbitmq_v3_7_0_milestone2","rabbitmq_v3_7_0_milestone1","rabbitmq_v3_6_0","rabbitmq_v3_6_0_rc3","rabbitmq_v3_6_0_rc2","rabbitmq_v3_6_0_rc1","rabbitmq_v3_6_0_milestone3","rabbitmq_v3_6_0_milestone2","rabbitmq_v3_6_0_milestone1","rabbitmq_v3_5_0","rabbitmq_v3_4_4","rabbitmq_v3_4_3","rabbitmq_v3_4_2","rabbitmq_v3_4_1","rabbitmq_v2_7_0","rabbitmq_v2_4_0","rabbitmq_v1_8_1","rabbitmq_v1_8_0","rabbitmq_v1_7_2","rabbitmq_v1_7_1","rabbitmq_v1_7_0","rabbitmq_v1_6_0","rabbitmq_v1_4_0"],"database_specific":{"vanir_signatures_modified":"2026-10-22T19:09:25Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-106121.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["270763962845842240998420853875191888627","83194574850271120551945190649757612216","294803679088535842114334935744370211097","91446109598190990967851069848746634684","235693158922043049651000487597878667675","12371646549381439319874435822315116094","66856958431972215751120805408152475418","30400149695438245955906524821459997464"],"threshold":0.9},"id":"CVE-2026-106121-48f2d2eb","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41","target":{"file":"src/main/java/com/rabbitmq/tools/json/JSONReader.java"}},{"target":{"file":"src/main/java/com/rabbitmq/tools/json/JSONReader.java","function":"string"},"deprecated":false,"digest":{"function_hash":"133638509552263276209130131259953087432","length":397},"id":"CVE-2026-106121-5a926fb9","signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41","target":{"file":"src/main/java/com/rabbitmq/tools/jsonrpc/JsonRpcServer.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["320496648438726301473250035449054578362","95728029130745313480420811566154944965","334466430276800096050679880704818700328","130991488717205056501258671795716903568"]},"id":"CVE-2026-106121-6fc8e805"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41","target":{"file":"src/main/java/com/rabbitmq/tools/json/JSONReader.java","function":"skipWhiteSpace"},"deprecated":false,"digest":{"length":233,"function_hash":"315763766914009131587666914086988765101"},"id":"CVE-2026-106121-a2d20155"},{"deprecated":false,"digest":{"line_hashes":["196040013556389698375258248213926648043","315681126217743703065163098398866469721","181219755514035373047247939129386260401","2048128575536568691977136557939389948","298785235106541279492479740016373684694","78046521289352656596644664421172960486","290302797840753543676360821718451908635"],"threshold":0.9},"id":"CVE-2026-106121-be3d0db1","signature_type":"Line","signature_version":"v1","source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41","target":{"file":"src/test/java/com/rabbitmq/client/test/JSONReadWriteTest.java"}},{"source":"https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41","target":{"file":"src/main/java/com/rabbitmq/tools/jsonrpc/JsonRpcServer.java","function":"doCall"},"deprecated":false,"digest":{"length":1694,"function_hash":"307672480226265302034398180442966691753"},"id":"CVE-2026-106121-c18387af","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H"}]}