rabbitmq-server vulnerabilities (Azure Linux)
77 vulnerabilities.
-
rabbitmq-serverAzure Linux Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose 5.9 Medium -
rabbitmq-serverAzure Linux ECDSA signature length is not validated in jose, allowing signature malleability 5.1 Medium -
rabbitmq-serverAzure Linux erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service 6.9 Medium -
rabbitmq-serverAzure Linux Weak PBKDF2 parameters for password-encrypted private-key export in jose 7.4 High -
rabbitmq-serverAzure Linux Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types 5.9 Medium -
rabbitmq-serverAzure Linux Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2 6.9 Medium -
rabbitmq-serverAzure Linux Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose 5.9 Medium -
rabbitmq-serverAzure Linux Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose 5.9 Medium -
rabbitmq-serverAzure Linux RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers 5.3 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Trust-store whitelist by Issuer+Serial only 9.1 Critical -
rabbitmq-serverAzure Linux RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling 4.5 Medium -
rabbitmq-serverAzure Linux RabbitMQ OAuth credential refresh retains revoked runtime tags 2.3 Low -
rabbitmq-serverAzure Linux RabbitMQ: Consecutive topic wildcards cause combinatorial routing work 7.1 High -
rabbitmq-serverAzure Linux RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service 5.9 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access 6.0 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass 6.0 Medium -
rabbitmq-serverAzure Linux RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint 8.2 High -
rabbitmq-serverAzure Linux RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS 8.2 High -
rabbitmq-serverAzure Linux RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass 5.1 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status 4.6 Medium -
rabbitmq-serverAzure Linux RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) 5.3 Medium -
rabbitmq-serverAzure Linux RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch 9.2 Critical -
rabbitmq-serverAzure Linux RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI 7.6 High -
rabbitmq-serverAzure Linux RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size 7.1 High -
rabbitmq-serverAzure Linux RabbitMQ: Monitoring-tag user can DELETE shovels 6.0 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Web-MQTT decompression bomb 8.2 High -
rabbitmq-serverAzure Linux RabbitMQ: Web-STOMP unbounded pre-auth accumulation 6.3 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata 6.9 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component 6.9 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Atom exhaustion: to_atom on global-parameter :name 5.9 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list 6.9 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Stream-protocol frame length never validated against frame_max 6.3 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Admin path-traversal write via trace name 2.1 Low -
rabbitmq-serverAzure Linux RabbitMQ: LDAP DN injection via unescaped substitution 6.3 Medium -
rabbitmq-serverAzure Linux RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client 5.9 Medium -
rabbitmq-serverAzure Linux RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords 5.9 Medium -
rabbitmq-serverAzure Linux RabbitMQ: JMS topic exchange erl_scan atom exhaustion 6.0 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Consistent-hash exchange unbounded weight 6.0 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS 8.2 High -
rabbitmq-serverAzure Linux RabbitMQ: protected tag bypass via bulk-delete 2.1 Low -
rabbitmq-serverAzure Linux RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI 7.3 High -
rabbitmq-serverAzure Linux RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure 2.3 Low -
rabbitmq-serverAzure Linux RabbitMQ: Monitoring-tag user can restart federation links 2.3 Low -
rabbitmq-serverAzure Linux RabbitMQ: ReDoS via management API ?name= filter 6.0 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Atom table exhaustion via management API node field 6.0 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Atom table exhaustion via stream `chunk_selector` 6.0 Medium -
rabbitmq-serverAzure Linux RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values 6.0 Medium -
rabbitmq-serverAzure Linux RabbitMQ: CORS * reflects Origin with Allow-Credentials 7.6 High -
rabbitmq-serverAzure Linux RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics 2.3 Low -
rabbitmq-serverAzure Linux RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs 5.6 Medium - Show olderLoading…