{"id":"CVE-2023-46118","aliases":["AZL-32107","AZL-35196","BIT-rabbitmq-2023-46118","DEBIAN-CVE-2023-46118","DLA-3687-1","DSA-5571-1","EUVD-2023-50377","GHSA-w6cq-9cf4-gqpg","OESA-2026-4028","OESA-2026-4029","OESA-2026-4030","OESA-2026-4031","OESA-2026-4032","RHSA-2024:0217","SUSE-FU-2024:2078-1","SUSE-SU-2023:4939-1","UBUNTU-CVE-2023-46118","USN-6501-1"],"status":"published","title":"Denial of Service by publishing large messages over the HTTP API","description":"RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \"out-of-memory killer\"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.01318,"percentile":0.71229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2023-10-24T23:27:06.952Z","modified":"2026-10-28T02:31:01Z","fixes":[{"ecosystem":"Hex","package":"rabbit_common","fixed_in":["3.12.7","3.11.24"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"rabbitmq-server","fixed_in":["3.11.24-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rabbitmq-server","fixed_in":["3.13.0-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"rabbitmq","fixed_in":["3.11.24","3.12.7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rabbitmq-server","fixed_in":["3.10.8-1.1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rabbitmq-server","fixed_in":["3.10.8-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rabbitmq-server","fixed_in":["3.10.8-3"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"rabbitmq-server","fixed_in":["3.8.2-1+deb10u2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"rabbitmq-server","fixed_in":["3.8.9-3+deb11u1"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"rabbitmq-server","fixed_in":["0:3.9.10-3.el9ost"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"rabbitmq-server","fixed_in":["3.8.11-150300.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"rabbitmq-server","fixed_in":["3.8.11-150300.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"rabbitmq-server","fixed_in":["3.8.11-150300.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"rabbitmq-server","fixed_in":["3.8.11-150300.3.14.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"rabbitmq-server","fixed_in":["3.8.2-0ubuntu1.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rabbitmq-server","fixed_in":["3.9.13-1ubuntu0.22.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rabbitmq-server","fixed_in":["3.12.1-1ubuntu1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Hex","package":"rabbit_common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.0"},{"fixed":"3.12.7"}]}]},{"source":"ghsa","ecosystem":"Hex","package":"rabbit_common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.11.0"},{"fixed":"3.11.24"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.24-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"rabbitmq","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.24"},{"introduced":"3.12.0"},{"fixed":"3.12.7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.8-1.1+deb12u1"}]}],"versions":["3.10.8-1.1"]},{"source":"osv","ecosystem":"Debian:13","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.8-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.8-3"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-1+deb10u2"}]}],"versions":["3.7.18-1","3.7.8-4","3.7.8-5","3.8.2-1+deb10u1"]},{"source":"osv","ecosystem":"Debian:11","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.9-3+deb11u1"}]}],"versions":["3.8.9-3"]},{"source":"osv","ecosystem":"Debian:12","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.8-1.1+deb12u1"}]}],"versions":["3.10.8-1.1"]},{"source":"osv","ecosystem":"Hex","package":"rabbit_common","ranges":[{"type":"SEMVER","events":[{"introduced":"3.12.0"},{"fixed":"3.12.7"}]}],"versions":["3.12.0","3.12.1","3.12.2","3.12.3","3.12.4","3.12.5","3.12.6"]},{"source":"osv","ecosystem":"Hex","package":"rabbit_common","ranges":[{"type":"SEMVER","events":[{"introduced":"3.11.0"},{"fixed":"3.11.24"}]}],"versions":["3.11.0","3.11.1","3.11.10","3.11.11","3.11.12","3.11.13","3.11.14","3.11.15","3.11.16","3.11.17","3.11.18","3.11.19","3.11.2","3.11.20","3.11.21","3.11.22","3.11.23","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.11.8","3.11.9"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.23-4.oe2403sp4"}]}],"bundled":11},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.23-3.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.23-4.oe2203sp4"}]}],"bundled":11},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.23-4.oe2403sp1"}]}],"bundled":11},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.23-4.oe2403sp3"}]}],"bundled":11},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.10-3.el9ost"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"elixir115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-150300.7.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"erlang26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.1-150300.7.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"rabbitmq-server313","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-150600.13.5.3"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"elixir115","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.7-150300.7.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"erlang26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"26.2.1-150300.7.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"rabbitmq-server313","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.1-150600.13.5.3"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.11-150300.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.11-150300.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.11-150300.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.11-150300.3.14.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.4-1","3.5.4-3","3.5.4-3.1","3.5.7-1","3.5.7-1ubuntu0.16.04.1","3.5.7-1ubuntu0.16.04.2","3.5.7-1ubuntu0.16.04.4","3.5.7-1ubuntu0.16.04.4+esm1","3.5.7-1ubuntu0.16.04.4+esm2","3.5.7-1ubuntu0.16.04.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.10-1","3.6.10-1ubuntu0.1","3.6.10-1ubuntu0.3","3.6.10-1ubuntu0.4","3.6.10-1ubuntu0.5","3.6.10-1ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-0ubuntu1.5"}]}],"versions":["3.7.8-4ubuntu2","3.7.18-1","3.8.2-0ubuntu1","3.8.2-0ubuntu1.1","3.8.2-0ubuntu1.2","3.8.2-0ubuntu1.3","3.8.2-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.13-1ubuntu0.22.04.2"}]}],"versions":["3.8.9-3ubuntu1","3.9.8-1","3.9.8-2","3.9.8-3","3.9.8-5","3.9.8-6","3.9.13-1","3.9.13-1ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.1-1ubuntu1"}]}],"versions":["3.12.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2-0ubuntu1.5"}]}],"versions":["3.7.8-4ubuntu2","3.7.18-1","3.8.2-0ubuntu1","3.8.2-0ubuntu1.1","3.8.2-0ubuntu1.2","3.8.2-0ubuntu1.3","3.8.2-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.13-1ubuntu0.22.04.2"}]}],"versions":["3.8.9-3ubuntu1","3.9.8-1","3.9.8-2","3.9.8-3","3.9.8-5","3.9.8-6","3.9.13-1","3.9.13-1ubuntu0.22.04.1"]}],"products":[{"vendor":"rabbitmq","product":"rabbitmq-server"},{"vendor":"vmware","product":"rabbitmq"}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"https://www.debian.org/security/2023/dsa-5571","tags":["x_transferred","web","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00009.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46118","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-w6cq-9cf4-gqpg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46118.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-46118","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4028","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30219","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44839","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57214","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57215","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57216","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57221","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67409","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67413","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4029","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4030","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4031","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4032","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:0217","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246512","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0217.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46118","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46118","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/-2024-2078/suse-fu-20242078-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1185075","tags":["report"]},{"url":"https://bugzilla.suse.com/1186203","tags":["report"]},{"url":"https://bugzilla.suse.com/1187818","tags":["report"]},{"url":"https://bugzilla.suse.com/1187819","tags":["report"]},{"url":"https://bugzilla.suse.com/1199431","tags":["report"]},{"url":"https://bugzilla.suse.com/1205267","tags":["report"]},{"url":"https://bugzilla.suse.com/1216582","tags":["report"]},{"url":"https://bugzilla.suse.com/1219532","tags":["report"]},{"url":"https://bugzilla.suse.com/1222591","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46118","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234939-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-46118","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6501-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-46118","title":"Denial of Service by publishing large messages over the HTTP API","description":"RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \"out-of-memory killer\"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.","status":"published","published":"2023-10-24T23:27:06.952Z","modified":"2025-02-13T17:14:16.64Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:35:23.645864Z"}],"euvd":[{"id":"EUVD-2023-50377","description":"RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API","status":"published","published":"2026-06-30T16:39:12Z","modified":"2026-06-30T16:39:12Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:21.147551Z"}],"ghsa":[{"id":"GHSA-w6cq-9cf4-gqpg","title":"RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API","description":"### Summary\n\nResponsibly disclosed by @NSEcho.\n\nHTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages. \n\n### Details\n\nAn authenticated user with sufficient credentials can publish a very large messages over the HTTP API\nand cause target node to be terminated by an \"out-of-memory killer\"-like mechanism.\n\nA PoC was provided to Team RabbitMQ privately.\n\n### Impact\n\nDenial of Service","status":"published","published":"2026-06-30T16:39:12Z","modified":"2026-06-30T16:39:14Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:40:35.701766Z"}],"nvd":[{"id":"CVE-2023-46118","description":"RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \"out-of-memory killer\"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.","status":"published","published":"2023-10-25T18:17:36.117Z","modified":"2026-06-17T06:30:11.217Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:08:40.004465Z"}],"osv":[{"id":"AZL-32107","title":"CVE-2023-46118 affecting package rabbitmq-server for versions less than 3.11.24-1","description":"RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \"out-of-memory killer\"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.","status":"published","published":"2023-10-25T18:17:36Z","modified":"2026-04-21T04:26:40.569876Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-35196","title":"CVE-2023-46118 affecting package rabbitmq-server for versions less than 3.13.0-1","description":"RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \"out-of-memory killer\"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.","status":"published","published":"2023-10-25T18:17:36Z","modified":"2026-04-21T04:51:37.682027Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"CVE-2023-46118","title":"Denial of Service by publishing large messages over the HTTP API","description":"RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \"out-of-memory killer\"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.","status":"published","published":"2023-10-24T23:27:06.952Z","modified":"2026-10-28T02:31:01.717221104Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DEBIAN-CVE-2023-46118","description":"RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \"out-of-memory killer\"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.","status":"published","published":"2023-10-25T18:17:36.117Z","modified":"2026-10-26T18:02:34.687006739Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"GHSA-w6cq-9cf4-gqpg","title":"RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API","description":"### Summary\n\nResponsibly disclosed by @NSEcho.\n\nHTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages. \n\n### Details\n\nAn authenticated user with sufficient credentials can publish a very large messages over the HTTP API\nand cause target node to be terminated by an \"out-of-memory killer\"-like mechanism.\n\nA PoC was provided to Team RabbitMQ privately.\n\n### Impact\n\nDenial of Service","status":"published","published":"2026-06-30T16:39:12Z","modified":"2026-06-30T16:45:17.913261799Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"OESA-2026-4028","title":"rabbitmq-server security update","description":"RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker.\r\n\r\nSecurity Fix(es):\n\nRabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \u0026quot;out-of-memory killer\u0026quot;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.(CVE-2023-46118)\n\nRabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions\nwill display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user\u0026apos;s browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.(CVE-2025-30219)\n\nRabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13,  This vulnerability is fixed in 4.1.2 and 4.0.13.(CVE-2026-44839)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.(CVE-2026-57212)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute JavaScript in the browser of a user viewing that page. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.(CVE-2026-57213)\n\nRabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange to execute JavaScript in another user\u0026apos;s browser. This issue is fixed in version 4.2.5.(CVE-2026-57214)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57215)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57216)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57221)\n\nAn authenticated tenant that is allowed to bind and publish to an `x-jms-topic` exchange can repeatedly consume RabbitMQ scheduler CPU while messages are routed. This delays publisher confirms and competes with unrelated broker work on the same node. The attacker can amplify the effect by publishing more messages or using multiple bindings, channels, or connections. The issue does not provide message disclosure, privilege escalation, or code execution. Its demonstrated impact is availability degradation. The reproduction establishes substantial per-message CPU amplification but does not claim that a single test connection alone causes a complete node outage.(CVE-2026-67409)\n\nAn authenticated tenant that is allowed to bind and publish to an `x-jms-topic` exchange can repeatedly consume RabbitMQ scheduler CPU while messages are routed. This delays publisher confirms and competes with unrelated broker work on the same node. The attacker can amplify the effect by publishing more messages or using multiple bindings, channels, or connections.\r\n\r\nThe issue does not provide message disclosure, privilege escalation, or code execution. Its demonstrated impact is availability degradation. The reproduction establishes substantial per-message CPU amplification but does not claim that a single test connection alone causes a complete node outage.(CVE-2026-67413)","status":"published","published":"2026-09-25T01:27:27Z","modified":"2026-09-25T01:45:06.393974498Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4029","title":"rabbitmq-server security update","description":"RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker.\r\n\r\nSecurity Fix(es):\n\nRabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \u0026quot;out-of-memory killer\u0026quot;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.(CVE-2023-46118)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.(CVE-2026-57212)","status":"published","published":"2026-09-25T01:27:28Z","modified":"2026-09-25T01:45:06.597582271Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4030","title":"rabbitmq-server security update","description":"RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker.\r\n\r\nSecurity Fix(es):\n\nRabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \u0026quot;out-of-memory killer\u0026quot;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.(CVE-2023-46118)\n\nRabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions\nwill display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user\u0026apos;s browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.(CVE-2025-30219)\n\nRabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13,  This vulnerability is fixed in 4.1.2 and 4.0.13.(CVE-2026-44839)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.(CVE-2026-57212)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute JavaScript in the browser of a user viewing that page. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.(CVE-2026-57213)\n\nRabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange to execute JavaScript in another user\u0026apos;s browser. This issue is fixed in version 4.2.5.(CVE-2026-57214)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57215)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57216)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57221)\n\nAn authenticated tenant that is allowed to bind and publish to an `x-jms-topic` exchange can repeatedly consume RabbitMQ scheduler CPU while messages are routed. This delays publisher confirms and competes with unrelated broker work on the same node. The attacker can amplify the effect by publishing more messages or using multiple bindings, channels, or connections. The issue does not provide message disclosure, privilege escalation, or code execution. Its demonstrated impact is availability degradation. The reproduction establishes substantial per-message CPU amplification but does not claim that a single test connection alone causes a complete node outage.(CVE-2026-67409)\n\nAn authenticated tenant that is allowed to bind and publish to an `x-jms-topic` exchange can repeatedly consume RabbitMQ scheduler CPU while messages are routed. This delays publisher confirms and competes with unrelated broker work on the same node. The attacker can amplify the effect by publishing more messages or using multiple bindings, channels, or connections.\r\n\r\nThe issue does not provide message disclosure, privilege escalation, or code execution. Its demonstrated impact is availability degradation. The reproduction establishes substantial per-message CPU amplification but does not claim that a single test connection alone causes a complete node outage.(CVE-2026-67413)","status":"published","published":"2026-09-25T01:27:29Z","modified":"2026-09-25T01:45:06.498825644Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4031","title":"rabbitmq-server security update","description":"RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker.\r\n\r\nSecurity Fix(es):\n\nRabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \u0026quot;out-of-memory killer\u0026quot;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.(CVE-2023-46118)\n\nRabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions\nwill display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user\u0026apos;s browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.(CVE-2025-30219)\n\nRabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13,  This vulnerability is fixed in 4.1.2 and 4.0.13.(CVE-2026-44839)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.(CVE-2026-57212)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute JavaScript in the browser of a user viewing that page. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.(CVE-2026-57213)\n\nRabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange to execute JavaScript in another user\u0026apos;s browser. This issue is fixed in version 4.2.5.(CVE-2026-57214)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57215)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57216)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57221)\n\nAn authenticated tenant that is allowed to bind and publish to an `x-jms-topic` exchange can repeatedly consume RabbitMQ scheduler CPU while messages are routed. This delays publisher confirms and competes with unrelated broker work on the same node. The attacker can amplify the effect by publishing more messages or using multiple bindings, channels, or connections. The issue does not provide message disclosure, privilege escalation, or code execution. Its demonstrated impact is availability degradation. The reproduction establishes substantial per-message CPU amplification but does not claim that a single test connection alone causes a complete node outage.(CVE-2026-67409)\n\nAn authenticated tenant that is allowed to bind and publish to an `x-jms-topic` exchange can repeatedly consume RabbitMQ scheduler CPU while messages are routed. This delays publisher confirms and competes with unrelated broker work on the same node. The attacker can amplify the effect by publishing more messages or using multiple bindings, channels, or connections.\r\n\r\nThe issue does not provide message disclosure, privilege escalation, or code execution. Its demonstrated impact is availability degradation. The reproduction establishes substantial per-message CPU amplification but does not claim that a single test connection alone causes a complete node outage.(CVE-2026-67413)","status":"published","published":"2026-09-25T01:27:29Z","modified":"2026-09-25T01:45:06.600685393Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4032","title":"rabbitmq-server security update","description":"RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker.\r\n\r\nSecurity Fix(es):\n\nRabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \u0026quot;out-of-memory killer\u0026quot;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.(CVE-2023-46118)\n\nRabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions\nwill display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user\u0026apos;s browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.(CVE-2025-30219)\n\nRabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13,  This vulnerability is fixed in 4.1.2 and 4.0.13.(CVE-2026-44839)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.(CVE-2026-57212)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute JavaScript in the browser of a user viewing that page. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.(CVE-2026-57213)\n\nRabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange to execute JavaScript in another user\u0026apos;s browser. This issue is fixed in version 4.2.5.(CVE-2026-57214)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57215)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57216)\n\nRabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57221)\n\nAn authenticated tenant that is allowed to bind and publish to an `x-jms-topic` exchange can repeatedly consume RabbitMQ scheduler CPU while messages are routed. This delays publisher confirms and competes with unrelated broker work on the same node. The attacker can amplify the effect by publishing more messages or using multiple bindings, channels, or connections. The issue does not provide message disclosure, privilege escalation, or code execution. Its demonstrated impact is availability degradation. The reproduction establishes substantial per-message CPU amplification but does not claim that a single test connection alone causes a complete node outage.(CVE-2026-67409)\n\nAn authenticated tenant that is allowed to bind and publish to an `x-jms-topic` exchange can repeatedly consume RabbitMQ scheduler CPU while messages are routed. This delays publisher confirms and competes with unrelated broker work on the same node. The attacker can amplify the effect by publishing more messages or using multiple bindings, channels, or connections.\r\n\r\nThe issue does not provide message disclosure, privilege escalation, or code execution. Its demonstrated impact is availability degradation. The reproduction establishes substantial per-message CPU amplification but does not claim that a single test connection alone causes a complete node outage.(CVE-2026-67413)","status":"published","published":"2026-09-25T01:27:30Z","modified":"2026-09-25T01:45:06.995037851Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"RHSA-2024:0217","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (rabbitmq-server) security update","status":"published","published":"2024-09-16T15:59:05Z","modified":"2026-10-20T10:02:29Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"UBUNTU-CVE-2023-46118","description":"RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \"out-of-memory killer\"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.","status":"published","published":"2023-10-25T18:17:00Z","modified":"2026-10-17T12:56:42.862432359Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"BIT-rabbitmq-2023-46118","title":"Denial of Service by publishing large messages over the HTTP API","description":"RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an \"out-of-memory killer\"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.","status":"published","published":"2024-03-06T11:03:02.882Z","modified":"2026-09-08T08:48:24.859014872Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"DLA-3687-1","title":"rabbitmq-server - security update","status":"published","published":"2023-12-13T00:00:00Z","modified":"2026-03-09T01:18:02.833351Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5571-1","title":"rabbitmq-server - security update","status":"published","published":"2023-12-01T00:00:00Z","modified":"2026-03-09T02:10:23.583988Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"SUSE-FU-2024:2078-1","title":"Feature update for rabbitmq-server313, erlang26, elixir115","description":"This update for rabbitmq-server313, erlang26, elixir115 fixes the following issues:\n\nrabbitmq-server was implemented with a parallel versioned RPM package at version 3.13.1 (jsc#PED-8414):\n    \n- Security issues fixed:\n\n  * CVE-2021-22116: Fixed improper input validation that may lead to Denial of Sercice (DoS) attacks (bsc#1186203)\n  * CVE-2021-32718, CVE-2021-32719: Fixed potential for JavaScript code execution in the management UI \n    (bsc#1187818, bsc#1187819)\n  * CVE-2022-31008: Fixed encryption key used to encrypt the URI was seeded with a predictable secret (bsc#1205267)\n  * CVE-2023-46118: Fixed HTTP API vulnerability for denial of service (DoS) attacks with very large messages\n    (bsc#1216582)\n    \n- Other bugs fixed:\n\n  * Fixed RabbitMQ maintenance status issue (bsc#1199431)\n  * Provide user/group for RPM 4.19 (bsc#1219532)\n  * Fixed `rabbitmqctl` command for `add_user` (bsc#1222591)\n  * Added hardening to systemd service(s) (bsc#1181400)\n  * Use /run instead of deprecated /var/run in tmpfiles.conf (bsc#1185075)\n\n- For the full list of upstream changes of this update between version 3.8.11 and 3.13.1 please consult:\n  \n  * https://www.rabbitmq.com/release-information\n    \nerlang26:\n\n- Provide RPM package as it's a dependency of rabbitmq-server313 (jsc#PED-8414)\n\nelixir115:\n    \n- Provide RPM package as needed in some cases by rabbitmq-server313 (jsc#PED-8414)\n\n","status":"published","published":"2024-06-19T03:36:36Z","modified":"2026-02-04T04:37:27.01078Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2023:4939-1","title":"Security update for rabbitmq-server","description":"This update for rabbitmq-server fixes the following issues:\n\n- CVE-2023-46118: Introduce HTTP request body limit for definition uploads (bsc#1216582).\n","status":"published","published":"2023-12-20T17:01:36Z","modified":"2026-02-04T03:01:22.174089Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-6501-1","title":"rabbitmq-server vulnerability","description":"It was discovered that RabbitMQ incorrectly handled certain HTTP requests.\nAn attacker could possibly use this issue to cause a denial of service.\n","status":"published","published":"2023-11-21T16:36:15Z","modified":"2026-04-27T16:57:48.454749Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}