CVE-2026-63336

Name of the Vulnerable Software and Affected Versions RabbitMQ Java client library versions prior to 5.33.0

Description The library allows Java and JVM-based applications to interact with RabbitMQ nodes. The functions useSslProtocol() and useSslProtocol(String) within com.rabbitmq.client.ConnectionFactory configure com.rabbitmq.client.TrustEverythingTrustManager and disable hostname verification. This allows arbitrary server certificates, including self-signed ones, to be accepted. A network attacker capable of intercepting a TLS connection can impersonate the RabbitMQ broker to read and modify protected AMQP traffic without certificate or hostname validation.

Recommendations Update to version 5.33.0.