VMware Rabbitmq Java Client vulnerabilities

5 CVEs affecting VMware Rabbitmq Java Client, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-106123, published 2026-10-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-11087, published 2018-09-14. Medium severity, CVSS 5.9. EPSS: 1.2% chance of exploitation in the next 30 days. Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability…
CVE-2023-46120, published 2023-10-25. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could…
CVE-2026-106121, published 2026-10-06. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate…
CVE-2026-106122, published 2026-10-06. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into…
CVE-2026-106123, published 2026-10-06. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri…