{"id":"CVE-2020-36282","aliases":["GHSA-v525-c3g5-cg9p"],"url":"https://o3.security/vulnerability/CVE-2020-36282","summary":"Unsafe Deserialization that can Result in Code Execution","details":"JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.","published":"2021-03-12T01:15:12.373Z","modified":"2026-07-08T21:26:11.374450Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.02844,"percentile":0.8555,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"com.rabbitmq.jms:rabbitmq-jms","fixedVersion":"2.2.0"},{"ecosystem":"Maven","name":"com.rabbitmq.jms:rabbitmq-jms","fixedVersion":"1.15.2"}],"fix":null,"references":[{"type":"WEB","url":"https://medium.com/%40ramon93i7/a99645d0448b"},{"type":"ADVISORY","url":"https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v1.15.2"},{"type":"ADVISORY","url":"https://github.com/rabbitmq/rabbitmq-jms-client/releases/tag/v2.2.0"},{"type":"FIX","url":"https://github.com/rabbitmq/rabbitmq-jms-client/issues/135"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T21:26:11.374450Z"}}