What is CVE-2026-106121?

CVE-2026-106121 is a medium-severity vulnerability in Rabbitmq Rabbitmq-Java-Client, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 4.9/10. Published 2026-10-06.

How severe is CVE-2026-106121?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Vulnerability in Rabbitmq Rabbitmq-Java-Client

CVE-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at CharacterIterator.DONE. The default DefaultJsonRpcMapper passes JSON-RPC message bodies to this parser for JsonRpcServer and client replies. A truncated string causes the parser to append replacement end markers until heap exhaustion, while a line comment without a terminating newline can keep a thread consuming CPU indefinitely, resulting in denial of service. This issue is fixed in version 5.37.0.

Published 2026-10-06 · last modified 2026-10-06.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Rabbitmq Rabbitmq-Java-Client — versions < 5.36.1

Weakness classification (CWE)

CWE-835 — Loop with Unreachable Exit Condition (Infinite Loop)

References

Frequently asked questions

What is CVE-2026-106121?: CVE-2026-106121 is a medium-severity vulnerability in Rabbitmq Rabbitmq-Java-Client, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 4.9/10. Published 2026-10-06.
How severe is CVE-2026-106121?: Medium severity. CVSS v3 base score is 4.9 out of 10.