CVE-2020-36282

9.8 criticalEPSS 2.8%

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2021-03-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

rabbitmq:jms_client

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-v525-c3g5-cg9p	Maven	com.rabbitmq.jms:rabbitmq-jms	>=2.0 <2.2.0	2.2.0
GHSA-v525-c3g5-cg9p	Maven	com.rabbitmq.jms:rabbitmq-jms	>=1.0 <1.15.2	1.15.2

References

https://github.com/rabbitmq/rabbitmq-jms-client/issues/135
https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2
https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0
https://medium.com/%40ramon93i7/a99645d0448b
https://github.com/rabbitmq/rabbitmq-jms-client/issues/135

Check your stack JSON