Upgrade to amqp-client 5.33.0 in 4.1.x (CVE-2026-63337)
Maintainers usually reply within 2 days
Nobody has claimed this yet.
Assessment
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Newbie friendliness
- 75/100
Research direction
Start with the managed dependency declaration in platform/spring-boot-dependencies/build.gradle and check how dependency versions are recorded nearby. Update the amqp-client version to 5.33.0, then verify the 4.1.x dependency metadata reflects that version.
Written by the indexing model from the issue text.
Description
The 4.1.x line currently manages com.rabbitmq:amqp-client 5.30.0 (library("Rabbit AMQP Client", "5.30.0") in platform/spring-boot-dependencies/build.gradle), which is in the affected range of CVE-2026-63337:
- Unsafe reflection (CWE-470) in
com.rabbitmq.tools.jsonrpc.JsonRpcClient: ajavaReturnTypevalue from an untrustedsystem.describeresponse is passed toClass.forName(...)with initialization enabled - Affects amqp-client ≥ 1.3.0 and < 5.33.0; fixed in 5.33.0
- CVSS v3 base score: 9.0
An attacker who can control broker responses (shared broker or network MITM) could trigger static initializers of classes already present in the victim JVM and cause type confusion.
Would you consider upgrading the managed amqp-client version to 5.33.0 in the 4.1.x branch? 5.33.0 stays on the 5.x line and is compatible with Spring AMQP 4.1.x / Spring Rabbit, so the upgrade should be a drop-in version bump.
Mend vulnerability database entry: https://www.mend.io/vulnerability-database/CVE-2026-63337/
- Dominant language
- Java
- Stars
- 81.7k
- Forks
- 45.1k
- Avg merge
- 3d 13h
- Merged PRs (30d)
- 58
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from spring-projects/spring-boot
-
X-Forwarded-Prefix can no longer be enabled with the NATIVE strategy on Reactor NettyPossibly taken @bclozel claimed this 1 day ago. Openstatus: waiting-for-triage
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
spring-projects/spring-boot#52316 · 1 comment · 1 assignee ·
Maintainers usually reply within 2 days
-
Maven process-test-aot only copies META-INF/native-image of the generated resources so the Logback configuration is lost in native testsPossibly taken @ZedingZhang claimed this 2 days ago. Openstatus: waiting-for-triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
spring-projects/spring-boot#52301 · 3 comments ·
Maintainers usually reply within 2 days
-
status: waiting-for-triage
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
spring-projects/spring-boot#52300 ·
Maintainers usually reply within 2 days
-
status: waiting-for-triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
spring-projects/spring-boot#52295 ·
Maintainers usually reply within 2 days
-
Prevent upgrade to Commons Codec 1.23.0Possibly taken @snicoll claimed this 3 days ago. Openstatus: team-only type: task
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
spring-projects/spring-boot#52143 · 2 comments · 1 assignee ·
Maintainers usually reply within 2 days
All issues in spring-projects/spring-boot
Similar issues
-
Shaded google-api-client trust stores still include AAA Certificate Services (eMudhra CA compromise)Open
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
snowflakedb/snowflake-jdbc#2763 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 79/100
java-native-access/jna#1746 ·
-
Pooled clients leak a connection per call: pipelines and transactions taken from UnifiedJedis are never closedPossibly taken @ali-jawad claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 77/100
-
kind:bug state:needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
OpenLineage/OpenLineage#5100 · 1 comment ·
Maintainers usually reply within 4 days
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
adorsys/keycloak-config-cli#1709 ·
Maintainers usually reply within 1 day