{"items":[{"id":"NVI-00011978","kind":"vulnerability","title":"RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-7822-rcf6-97fx","CVE-2026-106122"],"plain_summary":"GitHub lists this reviewed advisory for com.rabbitmq:amqp-client. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-77832ca5b1f117b63086df0741f01218"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-77832ca5b1f117b63086df0741f01218","url":"https://github.com/advisories/GHSA-7822-rcf6-97fx","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-7822-rcf6-97fx","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:46.232Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-77832ca5b1f117b63086df0741f01218"],"technology":"com.rabbitmq:amqp-client","known_exclusions":[],"conditions_summary":"### Summary\n\nA single AMQP message with malformed UTF-8 in a shortstr property (for example `correlation-id`) can permanently disable a Java client RPC consumer.\n\nThe client decodes malformed bytes into U+FFFD replacement characters. Each of those re-encodes to 3 bytes, so a 255-byte property becomes 765 bytes (over the 255-byte shortstr limit). When the application echoes that value back, as the documented RPC pattern does, the encoder throws an unchecked `IllegalArgumentException`. That kills the consumer loop or tears down the channel.\n\nThe message is never acknowledged, so the broker requeues it and it disables the next consumer that picks it up. Recovery does not help; the service stays down until an operator manually purges the queue.\n\nIn short: the decoder produces values the encoder rejects, and any client permitted to *use* an RPC service can permanently destroy it for everyone.\n\n### Details\n\n`ValueReader.readShortstr` decodes with `new String(b, StandardCharsets.UTF_8)`, which silently substitutes U+FFFD for malformed input:\n\nhttps://github.com/rabbitmq/rabbitmq-java-client/blob/main/src/main/java/com/rabbitmq/client/impl/ValueReader.java#L69-L75\n\n`ValueWriter.writeShorts","public_affected_ranges":["<= 5.35.0"]}],"null_published_at":"2026-11-01T01:03:56.619Z","source_updated_at":"2026-10-07T20:25:33.000Z","source_disclosed_at":"2026-10-07T20:25:29.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:58:46.232Z"}],"next_cursor":null,"snapshot_revision":"42594"}