What is CVE-2026-63336?
CVE-2026-63336 is a security vulnerability in the RabbitMQ Java client library prior to version 5.33.0. The `ConnectionFactory.useSslProtocol()` method uses `TrustEverythingTrustManager`, which trusts all SSL certificates, potentially enabling man-in-the-middle attacks. Users should immediately upgrade to version 5.33.0 or later.
Azərbaycanca: CVE-2026-63336 RabbitMQ Java müştəri kitabxanasında 5.33.0 versiyasından əvvəl təhlükəsizlik boşluğudur. `ConnectionFactory.useSslProtocol()` metodu `TrustEverythingTrustManager` istifadə edərək bütün SSL sertifikatlarını etibarlı hesab edir, bu isə man-in-the-middle hücumlarına şərait yaradır. İstifadəçilər dərhal 5.33.0 və ya daha yuxarı versiyaya yeniləməlidir.
Related CVEs
link basis: same weakness class CWE-287
FAQ2
In which component of RabbitMQ was the CVE-2026-63336 vulnerability discovered?
The vulnerability was discovered in the RabbitMQ Java client library, specifically in the `ConnectionFactory.useSslProtocol()` method.
What is the main risk of this security vulnerability?
The use of `TrustEverythingTrustManager` trusts all SSL certificates, potentially enabling man-in-the-middle attacks.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.