rabbitmq rabbitmq-server
77 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-67418 | >= 3.13.0, < 3.13.19 ; >= 4.0.0, < 4.0.24 ; >= 4.1.0, < 4.1.15 ; … | RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-67414 | >= 4.0.0, < 4.0.24 ; >= 4.1.0, < 4.1.15 ; >= 4.2.0, < 4.2.10 ; … | RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation | MEDIUM 6.0 | 0.6 % | ||
| CVE-2026-67416 | >= 4.0.0, < 4.0.24 ; >= 4.1.0, < 4.1.15 ; >= 4.2.0, < 4.2.10 ; … | RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation | MEDIUM 5.3 | 0.6 % | ||
| CVE-2026-67420 | >= 3.13.0, < 3.13.19 ; >= 4.0.0, < 4.0.24 ; >= 4.1.0, < 4.1.15 ; … | RabbitMQ OAuth credential refresh retains revoked runtime tags | LOW 2.3 | 0.3 % | ||
| CVE-2026-67419 | < 4.3.5 | RabbitMQ: Consecutive topic wildcards cause combinatorial routing work | HIGH 7.1 | 0.4 % | ||
| CVE-2026-67421 | >= 3.13.0, < 3.13.19 ; >= 4.0.0, < 4.0.24 ; >= 4.1.0, < 4.1.15 ; … | RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling | MEDIUM 4.5 | 0.3 % | ||
| CVE-2026-67408 | >= 4.3.0, < 4.3.3 ; >= 4.2.0, < 4.2.9 ; >= 4.1.0, < 4.1.11 | RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service | HIGH 7.1 | 0.4 % | ||
| CVE-2026-67406 | >= 4.3.0, < 4.3.3 ; >= 4.2.0, < 4.2.9 ; >= 4.1.0, < 4.1.14 ; … | RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status | MEDIUM 4.6 | 0.3 % | ||
| CVE-2026-67410 | >= 4.3.0, < 4.3.3 ; >= 4.2.0, < 4.2.9 | RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint | HIGH 8.2 | 0.4 % | ||
| CVE-2026-67227 | >= 4.0.0, < 4.0.22 ; >= 4.1.0, < 4.1.14 ; >= 4.2.0, < 4.2.7 ; … | RabbitMQ: Atom exhaustion: to_atom on global-parameter :name | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-67407 | >= 4.3.2, < 4.3.3 ; >= 4.2.0, < 4.2.9 ; >= 4.1.0, < 4.1.14 ; … | RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-67226 | >= 4.0.0, < 4.0.22 ; >= 4.1.0, < 4.1.14 ; >= 4.2.0, < 4.2.7 | RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-67411 | >= 4.3.0, < 4.3.3 ; >= 4.2.0, < 4.2.9 ; >= 4.1.0, < 4.1.14 ; … | RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-67413 | >= 4.2.0, < 4.2.9 ; >= 4.1.0, < 4.1.14 ; >= 4.3.0, < 4.3.3 ; … | RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression | MEDIUM 6.0 | 0.5 % | ||
| CVE-2026-61837 | >= 4.3.0, < 4.3.3 ; >= 4.2.0, < 4.2.9 ; >= 4.1.0, < 4.1.14 ; … | RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management pe… | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-67415 | >= 4.3.0, < 4.3.3 ; >= 4.2.0, < 4.2.9 | RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-67412 | >= 4.3.0, < 4.3.3 ; >= 4.2.0, < 4.2.9 ; >= 4.1.0, < 4.1.14 ; … | RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-67409 | >= 4.3.0, < 4.3.3 ; >= 4.2.0, < 4.2.9 ; >= 4.1.0, < 4.1.14 ; … | RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS | HIGH 8.2 | 0.4 % | ||
| CVE-2026-67242 | >= 4.2.0, < 4.2.9 ; >= 4.3.0, < 4.3.3 | RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-67223 | >= 3.13.0, < 3.13.18 ; >= 4.0.0, < 4.0.23 ; >= 4.1.0, < 4.1.14 ; … | RabbitMQ: LDAP DN injection via unescaped substitution | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-67239 | >= 3.13.0, < 3.13.18 ; >= 4.0.0, < 4.0.23 ; >= 4.1.0, < 4.1.14 ; … | RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI | HIGH 7.6 | 0.2 % | ||
| CVE-2026-67241 | >= 4.2.0, < 4.2.9 ; >= 4.3.0, < 4.3.3 | RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check | MEDIUM 4.8 | 0.4 % | ||
| CVE-2026-66071 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.22 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values | MEDIUM 6.0 | 0.5 % | ||
| CVE-2026-66078 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: protected tag bypass via bulk-delete | LOW 2.1 | 0.4 % | ||
| CVE-2026-66073 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Atom table exhaustion via management API node field | MEDIUM 6.0 | 0.5 % | ||
| CVE-2026-67237 | >= 4.2.0, < 4.2.8 ; >= 4.3.0, < 4.3.2 | RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint | HIGH 7.5 | 0.5 % | ||
| CVE-2026-67234 | >= 4.2.0, < 4.2.8 ; >= 4.3.0, < 4.3.2 | RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference | LOW 2.3 | 0.4 % | ||
| CVE-2026-67225 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Stream-protocol frame length never validated against frame_max | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-67230 | >= 4.2.0, < 4.2.6 ; >= 4.1.0, < 4.1.11 ; >= 4.0.0, < 4.0.20 ; … | RabbitMQ: Web-STOMP unbounded pre-auth accumulation | MEDIUM 6.3 | 0.6 % | ||
| CVE-2026-67222 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-67236 | >= 4.2.0, < 4.2.8 ; >= 4.3.0, < 4.3.2 | RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login | HIGH 8.2 | 0.2 % | ||
| CVE-2026-67233 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Monitoring-tag user can DELETE shovels | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-67221 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords | MEDIUM 5.9 | 0.2 % | ||
| CVE-2026-67231 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Trust-store whitelist by Issuer+Serial only | CRITICAL 9.1 | 0.2 % | ||
| CVE-2026-67218 | >= 4.0.0, < 4.0.22 ; >= 4.1.0, < 4.1.11 ; >= 4.2.0, < 4.2.6 | RabbitMQ: Super-stream HTTP creation skips configure-permission check | LOW 2.1 | 0.4 % | ||
| CVE-2026-66074 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: ReDoS via management API ?name= filter | MEDIUM 6.0 | 0.4 % | ||
| CVE-2026-67232 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Web-MQTT decompression bomb | HIGH 8.2 | 0.4 % | ||
| CVE-2026-67405 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) | MEDIUM 5.3 | 0.1 % | ||
| CVE-2026-66075 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Monitoring-tag user can restart federation links | LOW 2.3 | 0.2 % | ||
| CVE-2026-67219 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Consistent-hash exchange unbounded weight | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-67228 | >= 4.2.0, < 4.2.7 ; >= 4.3.0, < 4.3.1 | RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-67235 | >= 4.2.0, < 4.2.6 ; >= 4.1.0, < 4.1.11 ; >= 4.0.0, < 4.0.20 ; … | RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size | HIGH 7.1 | 0.3 % | ||
| CVE-2026-66068 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs | MEDIUM 5.6 | 0.1 % | ||
| CVE-2026-67229 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-66080 | >= 4.1.0, < 4.1.11 ; >= 4.2.0, < 4.2.6 | RabbitMQ: Super-stream partitions unbounded allocation | MEDIUM 5.9 | 0.3 % | ||
| CVE-2026-67240 | >= 4.2.0, < 4.2.7 ; >= 4.3.0, < 4.3.1 | RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard | LOW 2.3 | 0.4 % | ||
| CVE-2026-66072 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Atom table exhaustion via stream `chunk_selector` | MEDIUM 6.0 | 0.5 % | ||
| CVE-2026-66067 | >= 4.2.0, < 4.2.7 ; >= 4.3.0, < 4.3.1 | RabbitMQ: Stream protocol skips per vhost per user connection limits | MEDIUM 6.0 | 0.4 % | ||
| CVE-2026-66069 | >= 4.1.0, < 4.1.13 ; >= 4.2.0, < 4.2.7 | RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics | LOW 2.3 | 0.3 % | ||
| CVE-2026-67404 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch | CRITICAL 9.2 | 0.2 % | ||
| CVE-2026-67220 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: JMS topic exchange erl_scan atom exhaustion | MEDIUM 6.0 | 0.3 % | ||
| CVE-2026-67224 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Admin path-traversal write via trace name | LOW 2.1 | 0.4 % | ||
| CVE-2026-66077 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI | HIGH 7.3 | 0.2 % | ||
| CVE-2026-66079 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS | HIGH 8.2 | 0.3 % | ||
| CVE-2026-66070 | >= 3.13.0, < 3.13.17 ; >= 4.0.0, < 4.0.22 ; >= 4.1.0, < 4.1.13 ; … | RabbitMQ: CORS * reflects Origin with Allow-Credentials | HIGH 7.6 | 0.4 % | ||
| CVE-2026-67238 | >= 4.2.0, < 4.2.7 ; >= 4.3.0, < 4.3.1 | RabbitMQ: Atom-table exhaustion via reply-to queue name decoding | HIGH 7.1 | 0.4 % | ||
| CVE-2026-66076 | >= 3.13.0, < 3.13.15 ; >= 4.0.0, < 4.0.20 ; >= 4.1.0, < 4.1.11 ; … | RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure | LOW 2.3 | 0.3 % | ||
| CVE-2026-57217 | >= 4.2.0, < 4.2.6 ; >= 4.1.0, < 4.1.11 ; >= 4.0.0, < 4.0.21 ; … | RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass | HIGH 7.0 | 0.4 % | ||
| CVE-2026-57221 | >= 4.2.0, < 4.2.6 ; >= 4.1.0, < 4.1.11 ; >= 4.0.0, < 4.0.21 ; … | RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-57215 | >= 4.2.0, < 4.2.6 ; >= 4.1.0, < 4.1.11 ; >= 4.0.0, < 4.0.21 ; … | RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom | HIGH 7.0 | 0.4 % | ||
| CVE-2026-57219 | >= 4.2.0, < 4.2.6 ; >= 4.1.0, < 4.1.11 ; >= 4.0.0, < 4.0.21 ; … | RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations | HIGH 8.7 | 2.8 % | ||
| CVE-2026-57218 | >= 4.2.0, < 4.2.6 | RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure | MEDIUM 4.9 | 0.4 % | ||
| CVE-2026-57216 | >= 4.2.0, < 4.2.6 ; >= 4.1.0, < 4.1.11 ; >= 4.0.0, < 4.0.21 ; … | RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback c… | CRITICAL 10.0 | 0.5 % | ||
| CVE-2026-57220 | >= 4.2.0, < 4.2.6 | RabbitMQ: Stream listener does not enforce configured frame-size limit during authentication, permitting unauth'd mem-exhaust DoS | HIGH 7.5 | 0.5 % | ||
| CVE-2026-57214 | >= 4.2.0, < 4.2.5 | RabbitMQ: Stored XSS in RabbitMQ management UI | HIGH 7.1 | 0.2 % | ||
| CVE-2026-57211 | >= 4.2.0, < 4.2.6 ; >= 4.1.0, < 4.1.11 | RabbitMQ: UNC SSRF affecting the management UI on Windows | CRITICAL 10.0 | 0.6 % | ||
| CVE-2026-57212 | >= 4.2.0, < 4.2.5 ; >= 4.1.0, < 4.1.10 ; >= 4.0.0, < 4.0.19 ; … | RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size | HIGH 7.1 | 0.4 % | ||
| CVE-2026-57213 | >= 4.2.0, < 4.2.5 ; >= 4.1.0, < 4.1.10 ; >= 4.0.0, < 4.0.19 ; … | RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering | MEDIUM 5.7 | 0.3 % | ||
| CVE-2026-44839 | >= 3.7.0, < 4.0.13 ; >= 4.1.0-alpha, < 4.1.2 | RabbitMQ: Unsanitized vhost names allow for XSS in management UI | MEDIUM 5.6 | 0.2 % | ||
| CVE-2026-44838 | >= 4.2.0, < 4.2.4 | RabbitMQ MQTT Topic Permission Authorization Bypass | MEDIUM 5.3 | 0.2 % | ||
| CVE-2025-50200 | <= 3.13.7 | RabbitMQ Node can log Basic Auth header from an HTTP request | MEDIUM 6.7 | 0.2 % | ||
| CVE-2025-30219 | < 4.0.3 | RabbitMQ has XSS Vulnerability in an Error Message in Management UI | MEDIUM 6.1 | 0.2 % | ||
| CVE-2024-51988 | Open source RabbitMQ: >= 3.12.7, < 3.12.11 ; Tanzu RabbitMQ: >= 2.0.0, < 3.13.0 ; Tanzu RabbitMQ: < 1.5.2 | HTTP API's queue deletion endpoint does not verify that the user has a required permission | MEDIUM 6.5 | 0.4 % | ||
| CVE-2023-46118 | < 3.12.7 ; < 3.11.24 | Denial of Service by publishing large messages over the HTTP API | MEDIUM 4.9 | 1.3 % | ||
| CVE-2022-31008 | < 3.8.32 ; >= 3.9.0, < 3.9.18 ; >= 3.10.0, < 3.10.2 | Predictable credential obfuscation seed value used in rabbitmq-server | HIGH 7.5 | 0.4 % | ||
| CVE-2021-32719 | < 3.8.18 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ federation management plugin | MEDIUM 4.8 | 1.4 % | ||
| CVE-2021-32718 | < 3.8.17 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in RabbitMQ management UI | MEDIUM 5.4 | 1.4 % |