{"id":"CVE-2016-9877","aliases":["DEBIAN-CVE-2016-9877","DSA-3761-1","EUVD-2016-10668","GHSA-fjmp-8qvg-p73x","UBUNTU-CVE-2016-9877","USN-3374-1","openSUSE-SU-2024:11294-1"],"status":"published","title":"An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ...","description":"An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0139,"percentile":0.72497,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2016-12-29T00:00:00Z","modified":"2026-10-24T10:31:05Z","fixes":[{"ecosystem":"Debian:12","package":"rabbitmq-server","fixed_in":["3.6.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rabbitmq-server","fixed_in":["3.6.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rabbitmq-server","fixed_in":["3.6.6-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"rabbitmq-server","fixed_in":["3.3.5-1.1+deb8u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"rabbitmq-server","fixed_in":["3.2.4-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"rabbitmq-server","fixed_in":["3.5.7-1ubuntu0.16.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.5-1.1+deb8u1"}]}],"versions":["3.3.5-1.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1ubuntu0.1"}]}],"versions":["3.1.3-1","3.1.5-1","3.2.0-1","3.2.1-1","3.2.2-1","3.2.3-1","3.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.7-1ubuntu0.16.04.2"}]}],"versions":["3.5.4-1","3.5.4-3","3.5.4-3.1","3.5.7-1","3.5.7-1ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.4-1ubuntu0.1"}]}],"versions":["3.1.3-1","3.1.5-1","3.2.0-1","3.2.1-1","3.2.2-1","3.2.3-1","3.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.7-1ubuntu0.16.04.2"}]}],"versions":["3.5.4-1","3.5.4-3","3.5.4-3.1","3.5.7-1","3.5.7-1ubuntu0.16.04.1"]}],"products":[{"vendor":"broadcom","product":"rabbitmq_server"},{"vendor":"pivotal_software","product":"rabbitmq"}],"references":[{"url":"https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbst03880en_us","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/95065","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://pivotal.io/security/cve-2016-9877","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory","advisory","report"]},{"url":"http://www.debian.org/security/2017/dsa-3761","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-9877"},{"url":"https://github.com/advisories/GHSA-fjmp-8qvg-p73x"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-9877","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-9877","tags":["report"]},{"url":"https://github.com/rabbitmq/rabbitmq-mqtt/pull/98","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3374-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-9877","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9877","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-9877","description":"An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.","status":"published","published":"2016-12-29T09:02:00Z","modified":"2024-08-06T03:07:30.822Z","updated_at":"2026-11-02T14:33:32.103757Z"}],"euvd":[{"id":"EUVD-2016-10668","description":"An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.","status":"published","published":"2016-12-29T09:02:00Z","modified":"2024-08-06T03:07:30Z","updated_at":"2026-11-03T02:22:25.833438Z"}],"ghsa":[{"id":"GHSA-fjmp-8qvg-p73x","title":"An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ...","description":"An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.","status":"published","published":"2022-05-13T01:03:07Z","modified":"2023-02-01T05:02:30Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:49:55.565803Z"}],"nvd":[{"id":"CVE-2016-9877","description":"An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.","status":"published","published":"2016-12-29T09:59:00.79Z","modified":"2026-06-17T00:56:42.9Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:03:33.686843Z"}],"osv":[{"id":"CVE-2016-9877","description":"An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.","status":"published","published":"2016-12-29T09:59:00.79Z","modified":"2026-10-24T10:31:05.396903351Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:03.472693Z"},{"id":"DEBIAN-CVE-2016-9877","description":"An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.","status":"published","published":"2016-12-29T09:59:00.79Z","modified":"2026-09-22T07:02:19.12538829Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.207321Z"},{"id":"UBUNTU-CVE-2016-9877","description":"An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7. MQTT (MQ Telemetry Transport) connection authentication with a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request. Connections that use TLS with a client-provided certificate are not affected.","status":"published","published":"2016-12-29T00:00:00Z","modified":"2026-02-04T03:20:48.11572Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:13.356796Z"},{"id":"DSA-3761-1","title":"rabbitmq-server - security update","status":"published","published":"2017-01-13T00:00:00Z","modified":"2026-03-09T01:20:34.20105Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"openSUSE-SU-2024:11294-1","title":"erlang-rabbitmq-client-3.9.7-1.1 on GA media","description":"These are all security issues fixed in the erlang-rabbitmq-client-3.9.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:42:19.145496Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-3374-1","title":"rabbitmq-server vulnerability","description":"It was discovered that RabbitMQ incorrectly handled MQTT (MQ Telemetry\nTransport) authentication. A remote attacker could use this issue to\nauthenticate successfully with an existing username by omitting the\npassword.\n","status":"published","published":"2017-07-31T17:01:00Z","modified":"2026-02-10T04:41:11Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}