{"id":"CVE-2021-22116","aliases":["BIT-rabbitmq-2021-22116","DEBIAN-CVE-2021-22116","DLA-2710-1","EUVD-2021-9274","GHSA-5hjq-8gx9-79g4","MGASA-2021-0390","OESA-2026-3940","SUSE-FU-2024:2078-1","SUSE-SU-2021:3254-1","SUSE-SU-2021:3325-1","UBUNTU-CVE-2021-22116","USN-5004-1","openSUSE-SU-2021:1334-1","openSUSE-SU-2021:3325-1"],"status":"published","title":"RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to...","description":"RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01387,"percentile":0.72606,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-400"],"published":"2021-06-08T11:23:58Z","modified":"2026-10-24T10:30:50Z","fixes":[{"ecosystem":"Bitnami","package":"rabbitmq","fixed_in":["3.8.16"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rabbitmq-server","fixed_in":["3.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rabbitmq-server","fixed_in":["3.9.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rabbitmq-server","fixed_in":["3.9.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rabbitmq-server","fixed_in":["3.5.7-1ubuntu0.16.04.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"rabbitmq-server","fixed_in":["3.6.10-1ubuntu0.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"rabbitmq-server","fixed_in":["3.8.2-0ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rabbitmq-server","fixed_in":["3.8.9-3ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"rabbitmq","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.8.16"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.4-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.6-1+deb9u1"}]}],"versions":["3.6.6-1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:8","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.18-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.23-2.oe2003sp4"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"elixir115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-150300.7.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"erlang26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.1-150300.7.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"rabbitmq-server313","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-150600.13.5.3"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"elixir115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-150300.7.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"erlang26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.1-150300.7.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"rabbitmq-server313","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-150600.13.5.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3-3.3.4"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.11-3.3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.7-1ubuntu0.16.04.4+esm1"}]}],"versions":["3.5.4-1","3.5.4-3","3.5.4-3.1","3.5.7-1","3.5.7-1ubuntu0.16.04.1","3.5.7-1ubuntu0.16.04.2","3.5.7-1ubuntu0.16.04.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-1ubuntu0.5"}]}],"versions":["3.6.10-1","3.6.10-1ubuntu0.1","3.6.10-1ubuntu0.3","3.6.10-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-0ubuntu1.3"}]}],"versions":["3.7.8-4ubuntu2","3.7.18-1","3.8.2-0ubuntu1","3.8.2-0ubuntu1.1","3.8.2-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-3ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.7-1ubuntu0.16.04.4+esm1"}]}],"versions":["3.5.4-1","3.5.4-3","3.5.4-3.1","3.5.7-1","3.5.7-1ubuntu0.16.04.1","3.5.7-1ubuntu0.16.04.2","3.5.7-1ubuntu0.16.04.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.10-1ubuntu0.5"}]}],"versions":["3.6.10-1","3.6.10-1ubuntu0.1","3.6.10-1ubuntu0.3","3.6.10-1ubuntu0.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-0ubuntu1.3"}]}],"versions":["3.7.8-4ubuntu2","3.7.18-1","3.8.2-0ubuntu1","3.8.2-0ubuntu1.1","3.8.2-0ubuntu1.2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.3-lp152.2.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.11-3.3.3"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"vmware","product":"rabbitmq"},{"vendor":"vmware tanzu","product":"rabbitmq"}],"references":[{"url":"https://tanzu.vmware.com/security/cve-2021-22116","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22116","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5hjq-8gx9-79g4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-22116","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0390.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29174","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3940","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57216","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67413","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2024-2078/suse-fu-20242078-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1185075","tags":["report"]},{"url":"https://bugzilla.suse.com/1186203","tags":["report"]},{"url":"https://bugzilla.suse.com/1187818","tags":["report"]},{"url":"https://bugzilla.suse.com/1187819","tags":["report"]},{"url":"https://bugzilla.suse.com/1199431","tags":["report"]},{"url":"https://bugzilla.suse.com/1205267","tags":["report"]},{"url":"https://bugzilla.suse.com/1216582","tags":["report"]},{"url":"https://bugzilla.suse.com/1219532","tags":["report"]},{"url":"https://bugzilla.suse.com/1222591","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46118","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213254-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213325-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-22116","tags":["report"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/pull/2953","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5004-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22116","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-11287","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FWIIK75CV5Y6TWUXN67IYXFNHIHRZSXN/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7NL4I6R5WB6N3LAJGL2UC3TXXGKBNRLE/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-22116","description":"RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.","status":"published","published":"2021-06-08T11:23:58Z","modified":"2024-08-03T18:30:23.992Z","cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:57.701381Z"}],"euvd":[{"id":"EUVD-2021-9274","description":"RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.","status":"published","published":"2021-06-08T11:23:58Z","modified":"2024-08-03T18:30:23Z","updated_at":"2026-11-03T03:25:03.638882Z"}],"ghsa":[{"id":"GHSA-5hjq-8gx9-79g4","title":"RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to...","description":"RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.","status":"published","published":"2022-05-24T19:04:21Z","modified":"2023-01-29T05:06:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:46:07.317218Z"}],"nvd":[{"id":"CVE-2021-22116","description":"RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.","status":"published","published":"2021-06-08T12:15:10.347Z","modified":"2026-06-17T03:36:38.663Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400","CWE-20"],"updated_at":"2026-11-02T14:06:54.439974Z"}],"osv":[{"id":"CVE-2021-22116","description":"RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.","status":"published","published":"2021-06-08T12:15:10.347Z","modified":"2026-10-24T10:30:50.135498165Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-22116","description":"RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.","status":"published","published":"2021-06-08T12:15:10.347Z","modified":"2026-10-23T18:04:49.331898548Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"OESA-2026-3940","title":"rabbitmq-server security update","description":"RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker.\r\n\r\nSecurity Fix(es):\n\nRabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.(CVE-2021-22116)\n\nRabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange to execute JavaScript in another user\u0026apos;s browser. This issue is fixed in version 4.2.5.(CVE-2026-57214)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57215)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57216)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57221)\n\nAn authenticated tenant that is allowed to bind and publish to an `x-jms-topic` exchange can repeatedly consume RabbitMQ scheduler CPU while messages are routed. This delays publisher confirms and competes with unrelated broker work on the same node. The attacker can amplify the effect by publishing more messages or using multiple bindings, channels, or connections.\r\n\r\nThe issue does not provide message disclosure, privilege escalation, or code execution. Its demonstrated impact is availability degradation. The reproduction establishes substantial per-message CPU amplification but does not claim that a single test connection alone causes a complete node outage.(CVE-2026-67413)","status":"published","published":"2026-09-20T13:23:25Z","modified":"2026-09-20T13:30:27.968701676Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2021-22116","description":"RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.","status":"published","published":"2021-06-08T12:15:00Z","modified":"2026-02-04T03:43:22.317107Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"BIT-rabbitmq-2021-22116","description":"RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.","status":"published","published":"2024-03-06T11:03:52.789Z","modified":"2026-09-08T08:48:24.982101856Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"DLA-2710-1","title":"rabbitmq-server - security update","status":"published","published":"2021-07-19T00:00:00Z","modified":"2026-03-09T01:18:06.113642Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"MGASA-2021-0390","title":"Updated rabbitmq-server packages fix security vulnerabilities","description":"Updated rabbitmq-server packages fix security vulnerabilities:\n\nRabbitMQ all versions prior to 3.8.16 are prone to a denial of service\nvulnerability due to improper input validation in AMQP 1.0 client\nconnection endpoint. A malicious user can exploit the vulnerability by\nsending malicious AMQP messages to the target RabbitMQ instance having\nthe AMQP 1.0 plugin enabled (CVE-2021-22116).\n\nRabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior\nto version 3.8.17, a new user being added via management UI could lead\nto the user's bane being rendered in a confirmation message without proper\n\"\u003cscript\u003e\" tag sanitization, potentially allowing for JavaScript code\nexecution in the context of the page. In order for this to occur, the user\nmust be signed in and have elevated permissions (other user management)\n(CVE-2021-32718).\n\nRabbitMQ is a multi-protocol messaging broker. In rabbitmq-server prior\nto version 3.8.18, when a federation link was displayed in the RabbitMQ\nmanagement UI via the \"rabbitmq_federation_management\" plugin, its consumer\ntag was rendered without proper \u003cscript\u003e tag sanitization. This potentially\nallows for JavaScript code execution in the context of the page. The user\nmust be signed in and have elevated permissions (manage federation\nupstreams and policies) for this to occur (CVE-2021-32719).\n","status":"published","published":"2021-08-06T09:33:48Z","modified":"2026-04-16T04:42:53.984901036Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1334-1","title":"Security update for rabbitmq-server","description":"This update for rabbitmq-server fixes the following issues:\n\n- CVE-2021-32718: Fixed improper neutralization of script-related HTML tags in a web page (basic XSS) in management UI (bsc#1187818).\n- CVE-2021-32719: Fixed improper neutralization of script-related HTML tags in a web page (basic XSS) in federation management plugin (bsc#1187819).\n- CVE-2021-22116: Fixed improper input validation may lead to DoS (bsc#1186203).\n\n- Use /run instead of /var/run in tmpfiles.d configuration (bsc#1185075).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-10-04T14:05:48Z","modified":"2026-02-04T02:20:58.325405Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3325-1","title":"Security update for rabbitmq-server","description":"This update for rabbitmq-server fixes the following issues:\n\n- CVE-2021-32718: Fixed improper neutralization of script-related HTML tags in a web page (basic XSS) in management UI (bsc#1187818).\n- CVE-2021-32719: Fixed improper neutralization of script-related HTML tags in a web page (basic XSS) in federation management plugin (bsc#1187819).\n- CVE-2021-22116: Fixed improper input validation may lead to DoS (bsc#1186203).\n\n- Use /run instead of /var/run in tmpfiles.d configuration (bsc#1185075).\n","status":"published","published":"2021-10-09T17:45:06Z","modified":"2026-02-04T04:36:36.389504Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"SUSE-FU-2024:2078-1","title":"Feature update for rabbitmq-server313, erlang26, elixir115","description":"This update for rabbitmq-server313, erlang26, elixir115 fixes the following issues:\n\nrabbitmq-server was implemented with a parallel versioned RPM package at version 3.13.1 (jsc#PED-8414):\n    \n- Security issues fixed:\n\n  * CVE-2021-22116: Fixed improper input validation that may lead to Denial of Sercice (DoS) attacks (bsc#1186203)\n  * CVE-2021-32718, CVE-2021-32719: Fixed potential for JavaScript code execution in the management UI \n    (bsc#1187818, bsc#1187819)\n  * CVE-2022-31008: Fixed encryption key used to encrypt the URI was seeded with a predictable secret (bsc#1205267)\n  * CVE-2023-46118: Fixed HTTP API vulnerability for denial of service (DoS) attacks with very large messages\n    (bsc#1216582)\n    \n- Other bugs fixed:\n\n  * Fixed RabbitMQ maintenance status issue (bsc#1199431)\n  * Provide user/group for RPM 4.19 (bsc#1219532)\n  * Fixed `rabbitmqctl` command for `add_user` (bsc#1222591)\n  * Added hardening to systemd service(s) (bsc#1181400)\n  * Use /run instead of deprecated /var/run in tmpfiles.conf (bsc#1185075)\n\n- For the full list of upstream changes of this update between version 3.8.11 and 3.13.1 please consult:\n  \n  * https://www.rabbitmq.com/release-information\n    \nerlang26:\n\n- Provide RPM package as it's a dependency of rabbitmq-server313 (jsc#PED-8414)\n\nelixir115:\n    \n- Provide RPM package as needed in some cases by rabbitmq-server313 (jsc#PED-8414)\n\n","status":"published","published":"2024-06-19T03:36:36Z","modified":"2026-02-04T04:37:27.01078Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2021:3254-1","title":"Security update for rabbitmq-server","description":"This update for rabbitmq-server fixes the following issues:\n\n- CVE-2021-32718: Fixed improper neutralization of script-related HTML tags in a web page (basic XSS) in management UI (bsc#1187818).\n- CVE-2021-32719: Fixed improper neutralization of script-related HTML tags in a web page (basic XSS) in federation management plugin (bsc#1187819).\n- CVE-2021-22116: Fixed improper input validation may lead to DoS (bsc#1186203).\n\n- Use /run instead of /var/run in tmpfiles.d configuration (bsc#1185075).\n","status":"published","published":"2021-09-29T14:28:38Z","modified":"2026-02-04T03:07:03.536959Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3325-1","title":"Security update for rabbitmq-server","description":"This update for rabbitmq-server fixes the following issues:\n\n- CVE-2021-32718: Fixed improper neutralization of script-related HTML tags in a web page (basic XSS) in management UI (bsc#1187818).\n- CVE-2021-32719: Fixed improper neutralization of script-related HTML tags in a web page (basic XSS) in federation management plugin (bsc#1187819).\n- CVE-2021-22116: Fixed improper input validation may lead to DoS (bsc#1186203).\n\n- Use /run instead of /var/run in tmpfiles.d configuration (bsc#1185075).\n","status":"published","published":"2021-10-09T17:45:05Z","modified":"2026-02-04T04:05:09.746821Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"USN-5004-1","title":"rabbitmq-server vulnerabilities","description":"It was discovered that RabbitMQ incorrectly handled certain inputs.\nAn attacker could possibly use this issue to cause a denial of service. This\nissue only affected Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2019-11287)\n\nJonathan Knudsen discovered RabbitMQ incorrectly handled certain inputs.\nAn attacker could possibly use this issue to cause a denial of service.\n(CVE-2021-22116)\n","status":"published","published":"2021-06-24T15:04:30Z","modified":"2026-06-25T13:30:39.325998032Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}