Rabbitmq Rabbitmq-server vulnerabilities

• rabbitmq rabbitmq-server RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers CVE-2026-67418 Fix available 5.3 MediumOctober 14, 2026
• rabbitmq rabbitmq-server RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation CVE-2026-67414 Fix available 6.0 MediumOctober 14, 2026
• rabbitmq rabbitmq-server RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation CVE-2026-67416 Fix available 5.3 MediumOctober 14, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Trust-store whitelist by Issuer+Serial only CVE-2026-67231 Fix available 9.1 CriticalSeptember 23, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling CVE-2026-67421 Fix available 4.5 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ OAuth credential refresh retains revoked runtime tags CVE-2026-67420 Fix available 2.3 LowSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Consecutive topic wildcards cause combinatorial routing work CVE-2026-67419 Fix available 7.1 HighSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service CVE-2026-67415 Fix available 5.9 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access CVE-2026-67412 Fix available 6.0 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass CVE-2026-67411 Fix available 6.0 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CVE-2026-67410 Fix available 8.2 HighSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CVE-2026-67409 Fix available 8.2 HighSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service CVE-2026-67408 Fix available 7.1 HighSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass CVE-2026-67407 Fix available 5.1 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status CVE-2026-67406 Fix available 4.6 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) CVE-2026-67405 Fix available 5.3 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch CVE-2026-67404 Fix available 9.2 CriticalSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp CVE-2026-67242 Fix available 6.3 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check CVE-2026-67241 Fix available 4.8 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard CVE-2026-67240 Fix available 2.3 LowSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI CVE-2026-67239 Fix available 7.6 HighSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Atom-table exhaustion via reply-to queue name decoding CVE-2026-67238 Fix available 7.1 HighSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint CVE-2026-67237 Fix available 7.5 HighSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login CVE-2026-67236 Fix available 8.2 HighSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size CVE-2026-67235 Fix available 7.1 HighSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference CVE-2026-67234 Fix available 2.3 LowSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Monitoring-tag user can DELETE shovels CVE-2026-67233 Fix available 6.0 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Web-MQTT decompression bomb CVE-2026-67232 Fix available 8.2 HighSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Web-STOMP unbounded pre-auth accumulation CVE-2026-67230 Fix available 6.3 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata CVE-2026-67229 Fix available 6.9 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component CVE-2026-67228 Fix available 6.9 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Atom exhaustion: to_atom on global-parameter :name CVE-2026-67227 Fix available 5.9 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list CVE-2026-67226 Fix available 6.9 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Stream-protocol frame length never validated against frame_max CVE-2026-67225 Fix available 6.3 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Admin path-traversal write via trace name CVE-2026-67224 Fix available 2.1 LowSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: LDAP DN injection via unescaped substitution CVE-2026-67223 Fix available 6.3 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client CVE-2026-67222 Fix available 5.9 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords CVE-2026-67221 Fix available 5.9 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: JMS topic exchange erl_scan atom exhaustion CVE-2026-67220 Fix available 6.0 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Consistent-hash exchange unbounded weight CVE-2026-67219 Fix available 6.0 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Super-stream HTTP creation skips configure-permission check CVE-2026-67218 Fix available 2.1 LowSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Super-stream partitions unbounded allocation CVE-2026-66080 Fix available 5.9 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS CVE-2026-66079 Fix available 8.2 HighSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: protected tag bypass via bulk-delete CVE-2026-66078 Fix available 2.1 LowSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI CVE-2026-66077 Fix available 7.3 HighSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure CVE-2026-66076 Fix available 2.3 LowSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Monitoring-tag user can restart federation links CVE-2026-66075 Fix available 2.3 LowSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: ReDoS via management API ?name= filter CVE-2026-66074 Fix available 6.0 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Atom table exhaustion via management API node field CVE-2026-66073 Fix available 6.0 MediumSeptember 22, 2026
• broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Atom table exhaustion via stream `chunk_selector` CVE-2026-66072 Fix available 6.0 MediumSeptember 22, 2026
• Show olderLoading…