{"id":"CVE-2014-9650","aliases":["DEBIAN-CVE-2014-9650","EUVD-2014-9460","GHSA-7vh8-m3cm-3hh4","MGASA-2015-0240","RHSA-2016:0308","RHSA-2016:0367","RHSA-2016:0368","RHSA-2016:0369"],"status":"published","title":"CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4...","description":"CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02622,"percentile":0.85575,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2015-01-27T17:00:00Z","modified":"2026-10-23T15:47:36Z","fixes":[{"ecosystem":"Debian:12","package":"rabbitmq-server","fixed_in":["3.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rabbitmq-server","fixed_in":["3.4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rabbitmq-server","fixed_in":["3.4.1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:6::el7","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.5-18.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:7::el7","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.5-18.el7ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el6","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.5-6.1.el6ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:5::el7","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.5-18.el7ost"}]}],"bundled":2}],"products":[{"vendor":"broadcom","product":"rabbitmq_server"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2016-0308.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://groups.google.com/forum/#%21topic/rabbitmq-users/-3Z2FyGtXhs","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.rabbitmq.com/release-notes/README-3.4.1.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/76091","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2015/01/21/13","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9650","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/rabbitmq-users/-3Z2FyGtXhs","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7vh8-m3cm-3hh4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9650","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0240.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15120","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2015/01/27/8","tags":["web"]},{"url":"http://www.rabbitmq.com/news.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0308","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185514","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1185515","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1303747","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0308.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9649","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9649","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9649","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-9650","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9650","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0367","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0367.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0368","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0368.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0369","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1303748","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0369.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-9650","description":"CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.","status":"published","published":"2015-01-27T17:00:00Z","modified":"2024-08-06T13:47:41.815Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-9460","description":"CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.","status":"published","published":"2015-01-27T17:00:00Z","modified":"2024-08-06T13:47:41Z","updated_at":"2026-11-03T01:56:48.455518Z"}],"ghsa":[{"id":"GHSA-7vh8-m3cm-3hh4","title":"CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4...","description":"CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.","status":"published","published":"2022-05-13T01:03:07Z","modified":"2025-04-02T15:31:28Z","updated_at":"2026-11-02T15:00:36.145205Z"}],"nvd":[{"id":"CVE-2014-9650","description":"CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.","status":"published","published":"2015-01-27T20:03:15.08Z","modified":"2026-06-17T00:18:43.063Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:58.030217Z"}],"osv":[{"id":"CVE-2014-9650","description":"CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.","status":"published","published":"2015-01-27T20:03:15Z","modified":"2026-04-16T06:23:37.998346018Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9650","description":"CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.","status":"published","published":"2015-01-27T20:03:15.08Z","modified":"2026-10-23T15:47:36.158299118Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"MGASA-2015-0240","title":"Updated rabbitmq-server packages fix security vulnerabilities","description":"Updated rabbitmq-server package fixes security vulnerabilities:\n\nRabbitMQ before 3.4.1 does not prevent /api/* from returning text/html error\nmessages which could act as an XSS vector (CVE-2014-9649).\n\nRabbitMQ before 3.4.1 has a response-splitting vulnerability in /api/downloads\n(CVE-2014-9650).\n\nIn RabbitMQ before 3.4.3, some user-controllable content was not properly\nHTML-escaped before being presented to a user in the management web UI.\nAn attacker could publish a specially crafted message, policy name, or client\nversion to execute arbitrary Javascript code on behalf of a user who was\nviewing messages, policies, or connected clients in the management UI. In all\ncases, the attacker needs a valid user account on the targetted RabbitMQ\ncluster (CVE-2015-0862).\n\nThe rabbitmq-server package has been updated to version 3.5.3, fixing these\nissues and several other bugs.\n","status":"published","published":"2015-06-08T21:17:51Z","modified":"2026-04-16T06:24:56.872120441Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"RHSA-2016:0308","title":"Red Hat Security Advisory: rabbitmq-server security and bugfix update","status":"published","published":"2024-09-13T09:23:35Z","modified":"2026-06-29T10:11:36Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0367","title":"Red Hat Security Advisory: rabbitmq-server security and bugfix update","status":"published","published":"2024-09-13T09:23:30Z","modified":"2026-06-29T10:11:47Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0368","title":"Red Hat Security Advisory: rabbitmq-server security update","status":"published","published":"2024-09-13T09:23:46Z","modified":"2026-06-29T10:11:48Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0369","title":"Red Hat Security Advisory: rabbitmq-server security and bug fix update","status":"published","published":"2024-09-13T09:23:40Z","modified":"2026-06-29T10:11:48Z","updated_at":"2026-11-02T15:53:03.734507Z"}]}}