CVE-2026-63337: RabbitMQ Java Client Library RCE Flaw

CVE-2026-63337 Overview

CVE-2026-63337 is an unsafe reflection vulnerability [CWE-470] in the RabbitMQ Java client library. The flaw exists in com.rabbitmq.tools.jsonrpc.ProcedureDescription, which accepts an attacker-controlled javaReturnType value from an untrusted system.describe response. That value flows into Class.forName(javaReturnType) with class initialization enabled, triggering static initializers of arbitrary classes already present in the victim JVM. The issue impacts Java and JVM-based applications that use JsonRpcClient to interact with RabbitMQ brokers. All versions prior to 5.33.0 are affected.

Critical Impact
An attacker who can respond to a JsonRpcClient request through a shared broker or network interception can trigger static initializers of arbitrary loaded classes and cause type confusion, impacting confidentiality, integrity, and availability of the client process.

Affected Products

RabbitMQ Java client library (com.rabbitmq:amqp-client) versions prior to 5.33.0
Java and JVM-based applications using JsonRpcClient from the RabbitMQ Java client
Applications relying on com.rabbitmq.tools.jsonrpc.ProcedureDescription for RPC over RabbitMQ

Discovery Timeline

2026-08-18 - CVE-2026-63337 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-63337

Vulnerability Analysis

The vulnerability resides in the JSON-RPC support code of the RabbitMQ Java client. When a JsonRpcClient initializes, it issues a system.describe request to the remote service to retrieve procedure metadata. The response includes a javaReturnType string that the client uses to resolve the Java class expected as the return type.

The client passes this attacker-influenced string through JSONUtil.tryFill, setJavaReturnType, and computeReturnTypeAsJavaClass, ultimately reaching Class.forName(javaReturnType). Because the two-argument Class.forName form is used, the JVM performs class initialization, executing any static initializer of the loaded class. Later, JsonRpcClient.java passes the resolved type into mapper.parse, which can also produce type confusion during deserialization of the response payload.

Root Cause

The root cause is unsafe reflection [CWE-470]. The client trusts a value received over the wire to select which class to load and initialize. No allowlist restricts the target class, and initialization is not suppressed. Any class already reachable on the victim's classpath with side effects in its static initializer becomes an implicit exploitation gadget.

Attack Vector

Exploitation requires an attacker to answer a JsonRpcClient request. This is feasible when the client and server share a broker the attacker controls, when the attacker can publish to the reply queue, or when the attacker can intercept broker traffic. The attacker crafts a system.describe reply containing a chosen fully qualified class name in javaReturnType. On receipt, the client invokes Class.forName with initialization enabled and triggers the static initializer. Type confusion can be chained through the subsequent mapper.parse call.

java

            } else if ("void".equals(javaReturnType)) {
                return Void.TYPE;
            } else {
-                return Class.forName(javaReturnType);
+                return Class.forName(javaReturnType, false, Thread.currentThread().getContextClassLoader());
            }
        } catch (ClassNotFoundException e) {
            throw new IllegalStateException("Unable to load class: " + javaReturnType, e);

Source: rabbitmq-java-client commit 0032f75

The patch switches to the three-argument Class.forName form with the initialize parameter set to false, preventing static initializers from executing during class resolution.

Detection Methods for CVE-2026-63337

Indicators of Compromise

Unexpected system.describe responses containing fully qualified Java class names in the javaReturnType field that do not match legitimate RPC service signatures.
Class loading or static initializer activity in JVM processes hosting JsonRpcClient immediately after AMQP RPC exchanges.
Anomalous outbound network connections or file writes originating from JVMs shortly after receiving JSON-RPC replies.

Detection Strategies

Inventory Java applications for the com.rabbitmq:amqp-client dependency at versions below 5.33.0 using software composition analysis or SBOM tooling.
Enable JVM class loading logging (-verbose:class) in test environments to identify unexpected class initializations following JSON-RPC calls.
Inspect AMQP traffic on RPC reply queues for system.describe responses containing unusual class names in the javaReturnType property.

Monitoring Recommendations

Alert on JVM processes loading classes not referenced by their own application code, particularly following AMQP message consumption.
Monitor RabbitMQ broker audit logs for unauthorized publishers on reply queues used by JsonRpcClient consumers.
Correlate process behavior anomalies (spawned subprocesses, new outbound connections) with the timing of JSON-RPC exchanges.

How to Mitigate CVE-2026-63337

Immediate Actions Required

Upgrade the RabbitMQ Java client dependency (com.rabbitmq:amqp-client) to version 5.33.0 or later.
Audit all applications using com.rabbitmq.tools.jsonrpc.JsonRpcClient and prioritize patching those exposed to untrusted brokers or multi-tenant environments.
Restrict which principals can publish to RPC reply queues on RabbitMQ brokers used by JSON-RPC clients.

Patch Information

The issue is fixed in version 5.33.0 of the RabbitMQ Java client. The fix, applied in commits 0032f75 and 9f8e7ef, replaces Class.forName(javaReturnType) with Class.forName(javaReturnType, false, Thread.currentThread().getContextClassLoader()), disabling static initializer execution during class resolution. See GHSA-6g32-pxv4-2wfj and release v5.33.0 for full details.

Workarounds

Avoid using com.rabbitmq.tools.jsonrpc.JsonRpcClient against brokers or peers that are not fully trusted until upgrading.
Enforce TLS for all AMQP connections to prevent network interception of JSON-RPC traffic.
Apply strict RabbitMQ authorization policies so that only trusted producers can post to reply queues consumed by JSON-RPC clients.

bash

# Update Maven dependency to the fixed version
# pom.xml
# <dependency>
#   <groupId>com.rabbitmq</groupId>
#   <artifactId>amqp-client</artifactId>
#   <version>5.33.0</version>
# </dependency>

mvn versions:set-property -Dproperty=rabbitmq.version -DnewVersion=5.33.0
mvn dependency:tree | grep amqp-client