EUVD-2026-93777
GHSA-h6w7-qmcm-q6xr
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Leak is confined to local log/APM readers (AV:L, PR:L) and depends on a parse/TLS failure outside attacker control (AC:H); only credentials are disclosed, so C:H, I:N, A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2Blast Radius
ecosystem impact- 492 maven packages depend on com.rabbitmq:amqp-client (30 direct, 462 indirect)
Ecosystem-wide dependent count for version 5.35.0.
DescriptionCVE.org
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0.
AnalysisAI
RabbitMQ Java Client library releases prior to 5.35.0 can leak plaintext broker credentials because ConnectionFactoryConfigurator.load() wraps AMQP URI parsing failures in IllegalArgumentException messages that contain the raw amqp://user:pass@host URI. Any application that supplies credentials inside the connection URI and then hits a setup error - malformed URI syntax or a TLS NoSuchAlgorithmException/KeyManagementException - will write those credentials into startup logs, APM dashboards, CI output, or copied stack traces, where users without broker access may read them. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the application calls ConnectionFactoryConfigurator.load() with an AMQP URI that embeds plaintext credentials (amqp://user:pass@host); (2) that URI triggers an error during setup - either invalid URI syntax or a NoSuchAlgorithmException/KeyManagementException during TLS configuration - causing the pre-5.35.0 wrapped IllegalArgumentException to include the raw URI; and (3) an unauthorized party has read access to where that stack trace lands (startup logs, APM dashboards, CI logs, or copied/pasted traces). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-urgency credential-disclosure issue rather than a widely-exploitable critical flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to RabbitMQ Java client 5.35.0 (https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.35.0), which introduces the redactCredentials() helper and stops chaining the raw parse error; the change is described in advisory GHSA-h6w7-qmcm-q6xr (https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-h6w7-qmcm-q6xr) and the fix commit daca1875cdb8b8c0acce78f71103b21a05478446. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today