RHLW-2026-f4441c6bf0c89319

See a problem?
Please try reporting it to the source first.
Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-f4441c6bf0c89319.json
Import Source
https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-f4441c6bf0c89319.json
JSON Data
https://api.osv.dev/v1/vulns/RHLW-2026-f4441c6bf0c89319
Upstream
CVE (9)
GHSA (9)
Published
2026-11-05T13:47:45Z
Modified
2026-11-06T19:43:11Z
Severity
  • 6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Lightwell Security Advisory: amqp-client 5.30.0.rhlw-00016
Details

Red Hat Lightwell has released com.rabbitmq:amqp-client 5.30.0.rhlw-00016 with backported fixes for CVE-2026-106121, CVE-2026-106122, CVE-2026-106123, CVE-2026-61634, CVE-2026-63335, CVE-2026-63336, CVE-2026-63337, CVE-2026-69219, and CVE-2026-69220.

CVE-2026-106121: RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

CVE-2026-106122: RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers

CVE-2026-106123: RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

CVE-2026-61634: RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

CVE-2026-63335: RabbitMQ Java client malformed body frame triggers raw command assembler exception

CVE-2026-63336: RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM

CVE-2026-63337: RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

CVE-2026-69219: RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

CVE-2026-69220: RabbitMQ Java client ValueReader: Unbounded recursive table/array nesting causes StackOverflowError DoS

This patched artifact is a drop-in replacement for com.rabbitmq:amqp-client 5.30.0 from Maven Central.

References
Credits
    • Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / com.rabbitmq:amqp-client

Package

Name
com.rabbitmq:amqp-client
Purl
pkg:maven/com.rabbitmq/amqp-client

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.30.0
Fixed
5.30.0.rhlw-00016

Affected versions

5.*
5.30.0

Database specific

lightwell 
{
    "backport_base_version": "5.30.0",
    "remediated_version": "5.30.0.rhlw-00016",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}
source 
"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-f4441c6bf0c89319.json"