CVE-2026-63337

Name of the Vulnerable Software and Affected Versions RabbitMQ Java client library versions prior to 5.33.0

Description The RabbitMQ Java client library contains an issue where com.rabbitmq.tools.jsonrpc.ProcedureDescription processes a javaReturnType value from an untrusted system.describe response. This value is passed through JSONUtil.tryFill, setJavaReturnType, and computeReturnTypeAsJavaClass to Class.forName(javaReturnType) with initialization enabled. An attacker capable of intercepting network traffic or using a shared broker can specify a class already present in the victim JVM to trigger its static initializer. Additionally, JsonRpcClient.java passes the getReturnType output to mapper.parse, which may lead to type confusion. This can impact the confidentiality, integrity, and availability of the client process.

Recommendations Update to version 5.33.0.