CVE-2026-106121: Denial of Service via Infinite Loop in RabbitMQ Java Client JSON Parser

CVE-2026-106121 identifies a high-impact Denial of Service (DoS) vulnerability in the amqp-client artifact of the RabbitMQ Java Client. The flaw resides within the custom JSON deserialization class com.rabbitmq.tools.json.JSONReader. This component parses JSON-RPC message payloads sent to network interfaces processing RPC actions and client replies.

The parsing engine exposed by the client library relies on standard internal traversal logic to translate string-based serialized formats into JVM objects. Under default configurations, applications executing JsonRpcServer and JsonRpcClient utilize DefaultJsonRpcMapper, which internally registers JSONReader to map incoming requests. An attacker targeting this interface can submit malformed payloads that force the underlying parsing scanner into infinite loop loops.

This flaw belongs to the class of CWE-835 (Loop with Unreachable Exit Condition). Because the parser operates directly on incoming network sockets or input streams, exploitation bypasses standard application layer validation rules. The vulnerability represents an unauthenticated, remote vectors-of-attack vector, provided that the application exposes JSON-RPC endpoints to the network.

To understand the technical root cause of CVE-2026-106121, it is necessary to examine how JSONReader interacts with Java's standard java.text.StringCharacterIterator. This class maintains an internal pointer to traverse input strings character-by-character. When the iterator reaches the end of the input stream, subsequent invocations of next() perpetually return the constant sentinel value CharacterIterator.DONE (represented by \uFFFF).

The unpatched parser implementation fails to check for this sentinel value during loop operations within two primary parsing methods: skipWhiteSpace() and string(). Specifically, skipWhiteSpace() implements logic to handle inline single-line JavaScript-style comments starting with //. When processing a comment block, the code loops until it detects a line break (\n) character. If the payload ends abruptly with a comment that lacks a newline, the iterator reaches the end, returning \uFFFF. Since \uFFFF is never equal to \n, the scanner falls into an infinite loop that consumes 100% of the executing thread's CPU cycles.

A more destructive variant occurs inside the string() method, which deserializes quoted string literals. The loop continues to iterate and read characters until it encounters the matching closing delimiter. In a truncated payload (for example, {"method":"x), the closing quotation mark is never reached. The parser enters an infinite loop, reading the CharacterIterator.DONE sentinel (\uFFFF) and continually appending it to an internal StringBuilder instance. This leads to rapid heap memory consumption, ending in an unavoidable OutOfMemoryError that terminates the JVM process.

The vulnerability was mitigated in commit 25fad817291feff3195c32620117d295598f8b41 by incorporating explicit boundary checks against the CharacterIterator.DONE sentinel value. Let us examine the vulnerable block in JSONReader.java compared to the patched logic.

Prior to the patch, the loop in skipWhiteSpace scanned comments without verifying stream completion:

// Vulnerable comment scanning loop
else if (c == '/' && next() == '/') {
    while (c != '\n') {
        next();
    }
}

The updated implementation introduces a compound termination check that halts execution upon encountering the end-of-input sentinel:

// Patched comment scanning loop
else if (c == '/' && next() == '/') {
    while (c != '\n' && c != CharacterIterator.DONE) {
        next();
    }
}

Similarly, the string() method was hardened to detect stream exhaustion, throwing an explicit exception rather than executing indefinitely:

// Patched string parsing logic
private Object string(char sep) {
    buf.setLength(0);
    while (c != sep) {
        if (c == CharacterIterator.DONE) {
            throw new IllegalStateException(
                "Unterminated string while parsing JSON (around character "
                    + (it.getIndex() - it.getBeginIndex()) + ")");
        }
        if (c == '\\') {
            next();
            if (c == 'u') {
                // Unicode parsing logic...
            }
        }
        buf.append(c);
        next();
    }
}

Furthermore, the patch implements structural changes to JsonRpcServer.java to handle any unexpected runtime exceptions. Previously, the handler only intercepted ClassCastException occurrences, allowing other runtime errors to crash execution threads. The updated server wraps parsing and dispatch routines in a broad RuntimeException catch block, logging the error and returning an HTTP 400 Bad Request response to ensure server availability.

Exploitation of CVE-2026-106121 requires network access to endpoints implementing JsonRpcServer running on top of vulnerable versions of the RabbitMQ Java Client. An attacker must construct and transmit specialized, malformed JSON structures that trigger either the comment parsing loop or the string allocation loop.

To execute a Thread Exhaustion Attack (100% CPU usage), the attacker sends a payload terminated with a single-line comment. This can be accomplished with a minimal body such as {"method":"test"}//. Because the parsing thread cannot break out of the loop in skipWhiteSpace(), the host thread remains permanently active. If the attacker submits multiple identical requests, they can exhaust the server's thread pool, rendering the application unresponsive to legitimate users.

To execute a Heap Exhaustion Attack, the attacker transmits an unclosed string delimiter, such as " or ["x. The parsing thread enters the string() parser loop and allocates heap memory continuously by appending \uFFFF to the StringBuilder object. Because Java string builders double their capacity during resizing, this triggers exponential memory allocation, quickly overwhelming the JVM's maximum heap capacity (-Xmx). This results in a fatal java.lang.OutOfMemoryError crash that terminates the entire application server process.

The primary remediation for CVE-2026-106121 is updating the RabbitMQ Java Client (amqp-client) library to version 5.37.0 or higher. This version implements robust boundary checking inside the custom parser and protects the runtime thread of JsonRpcServer against unexpected parsing exceptions.

Because the custom JSON parsing framework in the com.rabbitmq.tools.json package is legacy and deprecated, development teams should transition away from it entirely. Replacing DefaultJsonRpcMapper with JacksonJsonRpcMapper mitigates the flaw by leveraging the Jackson parsing engine, which does not suffer from these parsing loop weaknesses. This migration represents a long-term architectural solution that increases both security and processing performance.

In environments where immediate software upgrades are not viable, administrators should configure upstream Web Application Firewalls (WAF) or ingress gateways to validate incoming JSON structures. Specifically, rules should reject incoming HTTP POST requests with malformed JSON-RPC payloads, trailing comments (such as those starting with //), or unmatched quotation marks. Implementing these filters blocks the malicious payloads before they are processed by the vulnerable JVM application threads.