CVE-2026-106122

Name of the Vulnerable Software and Affected Versions RabbitMQ Java client library versions prior to 5.36.0

Description The ValueReader.readShortstr function decodes malformed UTF-8 bytes into replacement characters that can re-encode beyond the AMQP shortstr limit enforced by ValueWriter.writeShortstr. An attacker can submit an RPC message with a malformed echoed property, causing reply publication in RpcServer.mainloop() or tutorial-style consumers to throw an unchecked exception before acknowledgement. Consequently, the broker requeues the message, which can disable replacement consumers until the queue is purged.

Recommendations Update to version 5.36.0.