HIGH GitHub
CVE-2026-63337
RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading
The JSON-RPC tools in `com.rabbitmq.tools.jsonrpc` perform `Class.forName(javaReturnType)` with `initialize=true` on class names received from untrusted AMQP messages, without any validation or allowlist.
**Vulnerable code** (`ProcedureDescription.java:101-127`):
When a `JsonRpcClient` connects, it calls `system.describe` and receives a service description from the AMQP queue. The response JSON includes `javaReturnType` fields that are reflectively set via `JSONUtil.tryFill()`, triggering `setJ
Affected Products
- maven/com.rabbitmq:amqp-client < 5.33.0
References
- https://github.com/advisories/GHSA-6g32-pxv4-2wfj
- https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-6g32-pxv4-2wfj
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2000
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2002
This high severity vulnerability was published on 2026-08-18 via GitHub. Affected: maven/com.rabbitmq:amqp-client < 5.33.0.
vulnfeed aggregates 11140 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.