Threats Tagged 'ghsa-cqgh-8p3p-mx4m'

CVE-2026-106121 is an infinite loop vulnerability in the rabbitmq-java-client library's JSONReader component. When parsing JSON input that ends inside a quoted string or a line comment, the parser loops indefinitely. This can cause either an OutOfMemoryError by filling the heap or a thread pinned at 100% CPU, resulting in denial of service. The issue affects applications using the JSON-RPC-over-AMQP tooling with the default DefaultJsonRpcMapper. The vulnerability is triggered by a single unauthenticated message and impacts availability of the JSON-RPC endpoint.