CVE-2026-63336: RabbitMQ Java client: TrustEverythingTrustManager used by default in useSslProtocol() enables MITM
com.rabbitmq.client.TrustEverythingTrustManager accepts ANY TLS certificate (including null chains) and is used as the default trust manager when calling ConnectionFactory.useSslProtocol() without arguments. Combined with hostname verification being disabled by default, this enables trivial man-in-the-middle attacks.
References
- github.com/advisories/GHSA-5m9f-rphj-c435
- github.com/rabbitmq/rabbitmq-java-client/commit/1e7deb2e6020c9793a81385a53ea378ec63b9339
- github.com/rabbitmq/rabbitmq-java-client/commit/a4bf571dd368765baaa9cecfae68ce09f1bdcc01
- github.com/rabbitmq/rabbitmq-java-client/pull/1999
- github.com/rabbitmq/rabbitmq-java-client/pull/2001
- github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.33.0
- github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-5m9f-rphj-c435
- nvd.nist.gov/vuln/detail/CVE-2026-63336
Code Behaviors & Features
Detect and mitigate CVE-2026-63336 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →