AIKIDO-2026-359738
amqp-client is vulnerable to Information Disclosure
57
Medium Risk
This Affects:
amqp-clientTL;DR
The ConnectionFactoryConfigurator builds connection settings from property files or maps and parses an AMQP URI that can embed a username and password. When URI parsing or TLS setup fails, the library places the raw connection string into the exception message without masking the userinfo. These messages expose the plaintext broker credentials through application logs, error trackers, and shared stack traces. The fix redacts the userinfo from URIs before including them in error messages.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you configure connections through ConnectionFactoryConfigurator with broker credentials embedded in the AMQP URI.
Background info
amqp-client is vulnerable to Information Disclosure in versions 0.0.1 - 5.34.0.
How to fix this
Upgrade the com.rabbitmq:amqp-client library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant