CVE-2026-63337: 
Java vulnerability analysis and mitigation

CVE-2026-63337 is an unsafe reflection vulnerability in the RabbitMQ Java client library (com.rabbitmq:amqp-client) that allows an attacker to trigger arbitrary class loading — including static initializer execution — in a victim's JVM. The flaw exists in com.rabbitmq.tools.jsonrpc.ProcedureDescription, which passes attacker-controlled javaReturnType values from an untrusted system.describe AMQP response directly to Class.forName() with initialization enabled. All versions prior to 5.33.0 are affected. It was disclosed on August 18, 2026, with a CVSS v4.0 base score of 7.5 (High) (GitHub Advisory).

The root cause is classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code — 'Unsafe Reflection'). When a JsonRpcClient connects to a JSON-RPC service over RabbitMQ, it calls system.describe and receives a service description from the AMQP queue. The response JSON contains javaReturnType fields that are reflectively set via JSONUtil.tryFill(), which triggers the call chain setJavaReturnType() → computeReturnTypeAsJavaClass() → Class.forName(javaReturnType) with the default initialize=true parameter (vulnerable code at ProcedureDescription.java:119-123). An attacker who can intercept or spoof the system.describe response — either as a co-tenant on a shared broker or via network interception — can supply an arbitrary class name, causing the victim JVM to load and execute that class's static initializer. Additionally, the loaded class is subsequently passed to mapper.parse(replyStr, expectedType) in JsonRpcClient.java:168, potentially enabling type confusion attacks (GitHub Advisory, Fix Commit).

Successful exploitation can affect confidentiality, integrity, and availability within the victim client process. By triggering static initializers of attacker-chosen classes already present in the victim JVM's classpath, an attacker may cause unintended code execution, data exfiltration, application crashes, or type confusion during JSON deserialization. The impact is scoped to the client-side JVM process rather than the RabbitMQ broker itself, but in environments where the client has access to sensitive data or downstream systems, exploitation could facilitate lateral movement (GitHub Advisory).

The NVD SSVC assessment classifies exploitation status as 'poc', indicating proof-of-concept code is available. Exploitation requires the attacker to have low-level privileges (e.g., access to a shared RabbitMQ broker) and the ability to intercept or respond to the victim's system.describe request, making it a network-based attack with some preconditions. The EPSS score is currently 0.0, and there is no evidence of in-the-wild exploitation or CISA KEV catalog inclusion at this time (GitHub Advisory).

1. Gain broker access or MITM position: Obtain access to a shared RabbitMQ broker (e.g., as a co-tenant) or establish a network interception position (e.g., ARP spoofing, rogue broker) between the victim JsonRpcClient and the legitimate RabbitMQ service.
2. Intercept the system.describe request: Monitor the AMQP queue for the victim client's initial system.describe RPC call, which is sent automatically when JsonRpcClient connects to a JSON-RPC service.
3. Craft a malicious response: Construct a JSON service description response containing a javaReturnType field set to the fully qualified name of a target class present in the victim JVM's classpath (e.g., a class with a known dangerous static initializer).
4. Deliver the malicious response: Reply to the victim's system.describe request with the crafted JSON payload via the AMQP queue before the legitimate server responds.
5. Trigger class loading: The victim's ProcedureDescription.computeReturnTypeAsJavaClass() calls Class.forName(attackerInput) with initialize=true, executing the static initializer of the attacker-specified class in the victim JVM.
6. Achieve objective: Depending on the class selected, the static initializer may execute arbitrary code, open network connections, or cause application instability. The loaded class is also passed to mapper.parse(), potentially enabling further type confusion exploitation (GitHub Advisory).

• Network: Unexpected or duplicate AMQP responses to system.describe RPC calls on RabbitMQ queues; unusual outbound connections from the Java client process following a JsonRpcClient connection event.
• Logs: Java application logs showing ClassNotFoundException or IllegalStateException with unexpected class names in ProcedureDescription; unexpected class loading events in JVM verbose class-loading output (-verbose:class).
• Process: Unusual child processes or threads spawned by the Java application process after a JsonRpcClient connection; unexpected static initializer execution logged by security monitoring agents (e.g., Java agents, RASP tools).
• File System: New or modified files created by the Java process in unexpected directories following a JsonRpcClient connection event.

Upgrade com.rabbitmq:amqp-client to version 5.33.0 or later, which fixes the vulnerability by changing the Class.forName() call to use initialize=false (Class.forName(javaReturnType, false, Thread.currentThread().getContextClassLoader())) and adding an allowlist of permitted return types in JsonRpcClient (GitHub Advisory, Fix PR). As a workaround for environments that cannot immediately upgrade, restrict access to shared RabbitMQ brokers to trusted tenants only and avoid using JsonRpcClient over untrusted or shared network segments. Network-level controls such as TLS mutual authentication between clients and the broker can reduce the risk of MITM-based exploitation.

The vulnerability was reported by security researcher lucianjohnhouse and acknowledged by the RabbitMQ maintainers, who merged the fix on June 29, 2026, with the reporter confirming the fix looked good. The advisory was publicly disclosed on August 18, 2026, via GitHub Security Advisories (GitHub Advisory). Tenable has published a cloud security plugin (446059) for detection, and the vulnerability has been indexed by GitLab Advisories and OSV (Tenable).