CVE-2026-63336
Reported by github_m · Published August 18, 2026
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) configure com.rabbitmq.client.TrustEverythingTrustManager and leave hostname verification disabled, causing arbitrary server certificates, including self-signed certificates, to be accepted. A network attacker able to intercept a TLS connection can impersonate the RabbitMQ broker, read protected AMQP traffic, and modify traffic without certificate or hostname validation. The fix changes the production TLS helpers to use the JVM default trust store and enables hostname verification, while retaining an explicitly named development-only no-verification helper. This issue is fixed in version 5.33.0.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| conductor-fips | Chainguard | 3.32.1-r1 |
| thingsboard | Chainguard | 4.3.1.3-r23 |
| logstash-fips-9.5 | Chainguard | 9.5.2-r1 |
| traccar-fips | Chainguard | 6.14.5-r10 |
| traccar | Chainguard | 6.14.5-r7 |
| thingsboard | Wolfi | 4.3.1.3-r23 |
| logstash-fips-9.4 | Chainguard | 9.4.5-r3 |
| zipkin | Chainguard | 3.6.1-r22 |
| cassandra-reaper | Wolfi | 5.0.0-r9 |
| nuxeo-2023 | Chainguard | 2023.45-r10 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| rabbitmq | rabbitmq-java-client | < 5.33.0 |
| chainguard | conductor-fips | 0 |
| chainguard | thingsboard | 0 |
| chainguard | logstash-fips-9.5 | 0 |
| chainguard | traccar-fips | 0 |
| chainguard | traccar | 0 |
| wolfi | thingsboard | 0 |
| chainguard | logstash-fips-9.4 | 0 |
| chainguard | zipkin | 0 |
| wolfi | cassandra-reaper | 0 |
| chainguard | nuxeo-2023 | 0 |
| rabbitmq | rabbitmq-java-client | 0 |
| wolfi | logstash-9.4 | 0 |
| chainguard | conductor | 0 |
| wolfi | zipkin | 0 |
| wolfi | druid | 0, 0 |
| chainguard | druid | 0, 0 |
| chainguard | logstash-9.4 | 0 |
| chainguard | logstash-9.2 | 0 |
| chainguard | logstash-9.5 | 0 |
…and 3 more
Timeline
- Aug 18, 2026 CVE Published
- Aug 22, 2026 Coalition ESS Score
- Aug 24, 2026 EPSS Score (16 in total, the first dated here)
- Sep 5, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-63336
vulnetix vdb fixes CVE-2026-63336Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-63336/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435 x_refsource_CONFIRM
- https://github.com/rabbitmq/rabbitmq-java-client/pull/1999 x_refsource_MISC
- https://github.com/rabbitmq/rabbitmq-java-client/pull/2001 x_refsource_MISC
- https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339 x_refsource_MISC
- https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01 x_refsource_MISC
- https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-63336 advisory
- https://github.com/advisories/GHSA-5m9f-rphj-c435 advisory