---
id: CVE-2026-63336
title: >-
  The RabbitMQ Java client library allows Java and JVM-based applications to
  connect to and interact with RabbitMQ nodes
summary: >-
  The RabbitMQ Java client library allows Java and JVM-based applications to
  connect to and interact with RabbitMQ nodes. Prior to 5.33.0,
  com.rabbitmq.client.ConnectionFactory.useSslProtocol() and
  ConnectionFactory.useSslProtocol(String) …
severity: medium
cwe:
  - CWE-295
vendor: rabbitmq
product: 'com.rabbitmq:amqp-client'
affected:
  - 'com.rabbitmq:amqp-client < 5.33.0'
patched:
  - 'com.rabbitmq:amqp-client 5.33.0'
published: '2026-08-18'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T20:32:09.380'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63336'
references:
  - url: >-
      https://github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-java-client/pull/1999'
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-java-client/pull/2001'
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-5m9f-rphj-c435'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.00307
epssPercentile: 0.20981
aliases:
  - GHSA-5m9f-rphj-c435
ecosystem: maven
ingestedAt: '2026-08-18T17:20:36.485Z'
---

## Overview

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.useSslProtocol() and ConnectionFactory.useSslProtocol(String) configure com.rabbitmq.client.TrustEverythingTrustManager and leave hostname verification disabled, causing arbitrary server certificates, including self-signed certificates, to be accepted. A network attacker able to intercept a TLS connection can impersonate the RabbitMQ broker, read protected AMQP traffic, and modify traffic without certificate or hostname validation. The fix changes the production TLS helpers to use the JVM default trust store and enables hostname verification, while retaining an explicitly named development-only no-verification helper. This issue is fixed in version 5.33.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-63336)

Affected packages:

- `com.rabbitmq:amqp-client < 5.33.0`

Patched in:

- `com.rabbitmq:amqp-client 5.33.0`

Source: https://github.com/advisories/GHSA-5m9f-rphj-c435