THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-6g32-pxv4-2wfj (high) — RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

[GHSA] GHSA-6g32-pxv4-2wfj (high) — RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

medgithub_advisoriesPublished 2026-08-18

GHSA-6g32-pxv4-2wfj Severity: high CVE: CVE-2026-63337

RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading

The JSON-RPC tools in `com.rabbitmq.tools.jsonrpc` perform `Class.forName(javaReturnType)` with `initialize=true` on class names received from untrusted AMQP messages, without any validation or allowlist.

**Vulnerable code** (`Pr

Indicators of compromise

CVE-2026-63337cve

Original source: https://github.com/advisories/GHSA-6g32-pxv4-2wfj