CVE-2020-36282
Unsafe Deserialization that can Result in Code Execution
CVE-2020-36282 is a critical vulnerability (CVSS 9.8) in Rabbitmq Jms Client, published March 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.84%, the 86th percentile. Fixed in com.rabbitmq.jms:rabbitmq-jms 2.2.0.
JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
- Record
CVE-2020-36282- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE List No score
JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
- Record
CVE-2020-36282- Updated
- 2026-11-02
EUVDEUVD-2021-2590 No score
JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
- Record
EUVD-2021-2590- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v525-c3g5-cg9p No score
Unsafe Deserialization that can Result in Code Execution
JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
- Record
GHSA-v525-c3g5-cg9p- Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
- Record
CVE-2020-36282- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-v525-c3g5-cg9p No score
Unsafe Deserialization that can Result in Code Execution
JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
- Record
GHSA-v525-c3g5-cg9p- Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.rabbitmq.jms:rabbitmq-jmsMaven |
2.0 up to 2.2.0 | 2.2.0 |
com.rabbitmq.jms:rabbitmq-jmsMaven |
1.0 up to 1.15.2 | 1.15.2 |
com.rabbitmq.jms:rabbitmq-jmsMaven |
2.0 up to 2.2.0, plus listed versions 2.0.02.1.02.1.1 |
2.2.0 |
com.rabbitmq.jms:rabbitmq-jmsMaven |
1.0 up to 1.15.2, plus listed versions 1.10.01.11.01.11.11.11.21.12.0 Show 11 moreShow less1.13.01.14.01.15.01.15.11.4.71.5.01.6.01.7.01.8.01.8.11.9.0 |
1.15.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
medium.com/%40ramon93i7/a99645d0448b
github.com/rabbitmq/rabbitmq-jms-client/issues/135
nvd.nist.gov/vuln/detail/CVE-2020-36282