PT-2026-77211
CVE-2026-63337
·
Published
2026-08-18
·
Updated
2026-10-30
Description by
CVSS 4.0
7.5
HighMetricsAV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
RabbitMQ Java client library versions prior to 5.33.0
Description
The RabbitMQ Java client library contains an issue where
com.rabbitmq.tools.jsonrpc.ProcedureDescription processes a javaReturnType value from an untrusted system.describe response. This value is passed through JSONUtil.tryFill, setJavaReturnType, and computeReturnTypeAsJavaClass to Class.forName(javaReturnType) with initialization enabled. An attacker capable of intercepting network traffic or using a shared broker can specify a class already present in the victim JVM to trigger its static initializer. Additionally, JsonRpcClient.java passes the getReturnType output to mapper.parse, which may lead to type confusion. This can impact the confidentiality, integrity, and availability of the client process.Recommendations
Update to version 5.33.0.
Found an issue in the description? Have something to add? Feel free to write us 👾