rabbitmq-server vulnerabilities (Debian)
89 vulnerabilities.
-
rabbitmq-serverDebian RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers 5.3 Medium -
rabbitmq-serverDebian RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation 6.0 Medium -
rabbitmq-serverDebian RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation 5.3 Medium -
rabbitmq-serverDebian RabbitMQ: Trust-store whitelist by Issuer+Serial only 9.1 Critical -
rabbitmq-serverDebian RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling 4.5 Medium -
rabbitmq-serverDebian RabbitMQ OAuth credential refresh retains revoked runtime tags 2.3 Low -
rabbitmq-serverDebian RabbitMQ: Consecutive topic wildcards cause combinatorial routing work 7.1 High -
rabbitmq-serverDebian RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service 5.9 Medium -
rabbitmq-serverDebian RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access 6.0 Medium -
rabbitmq-serverDebian RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass 6.0 Medium -
rabbitmq-serverDebian RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint 8.2 High -
rabbitmq-serverDebian RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS 8.2 High -
rabbitmq-serverDebian RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service 7.1 High -
rabbitmq-serverDebian RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass 5.1 Medium -
rabbitmq-serverDebian RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status 4.6 Medium -
rabbitmq-serverDebian RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) 5.3 Medium -
rabbitmq-serverDebian RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch 9.2 Critical -
rabbitmq-serverDebian RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp 6.3 Medium -
rabbitmq-serverDebian RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check 4.8 Medium -
rabbitmq-serverDebian RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard 2.3 Low -
rabbitmq-serverDebian RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI 7.6 High -
rabbitmq-serverDebian RabbitMQ: Atom-table exhaustion via reply-to queue name decoding 7.1 High -
rabbitmq-serverDebian RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint 7.5 High -
rabbitmq-serverDebian RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login 8.2 High -
rabbitmq-serverDebian RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size 7.1 High -
rabbitmq-serverDebian RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference 2.3 Low -
rabbitmq-serverDebian RabbitMQ: Monitoring-tag user can DELETE shovels 6.0 Medium -
rabbitmq-serverDebian RabbitMQ: Web-MQTT decompression bomb 8.2 High -
rabbitmq-serverDebian RabbitMQ: Web-STOMP unbounded pre-auth accumulation 6.3 Medium -
rabbitmq-serverDebian RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata 6.9 Medium -
rabbitmq-serverDebian RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component 6.9 Medium -
rabbitmq-serverDebian RabbitMQ: Atom exhaustion: to_atom on global-parameter :name 5.9 Medium -
rabbitmq-serverDebian RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list 6.9 Medium -
rabbitmq-serverDebian RabbitMQ: Stream-protocol frame length never validated against frame_max 6.3 Medium -
rabbitmq-serverDebian RabbitMQ: Admin path-traversal write via trace name 2.1 Low -
rabbitmq-serverDebian RabbitMQ: LDAP DN injection via unescaped substitution 6.3 Medium -
rabbitmq-serverDebian RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client 5.9 Medium -
rabbitmq-serverDebian RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords 5.9 Medium -
rabbitmq-serverDebian RabbitMQ: JMS topic exchange erl_scan atom exhaustion 6.0 Medium -
rabbitmq-serverDebian RabbitMQ: Consistent-hash exchange unbounded weight 6.0 Medium -
rabbitmq-serverDebian RabbitMQ: Super-stream HTTP creation skips configure-permission check 2.1 Low -
rabbitmq-serverDebian RabbitMQ: Super-stream partitions unbounded allocation 5.9 Medium -
rabbitmq-serverDebian RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS 8.2 High -
rabbitmq-serverDebian RabbitMQ: protected tag bypass via bulk-delete 2.1 Low -
rabbitmq-serverDebian RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI 7.3 High -
rabbitmq-serverDebian RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure 2.3 Low -
rabbitmq-serverDebian RabbitMQ: Monitoring-tag user can restart federation links 2.3 Low -
rabbitmq-serverDebian RabbitMQ: ReDoS via management API ?name= filter 6.0 Medium -
rabbitmq-serverDebian RabbitMQ: Atom table exhaustion via management API node field 6.0 Medium -
rabbitmq-serverDebian RabbitMQ: Atom table exhaustion via stream `chunk_selector` 6.0 Medium - Show olderLoading…