Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

rabbitmq-server — Vulnerabilities & Security Advisories 74

All 74 CVE vulnerabilities found in rabbitmq-server, with AI-generated Chinese analysis, references, and POCs.

This page documents security vulnerabilities affecting the rabbitmq-server product, specifically focusing on Common Weakness Enumerations relevant to this message broker software. It aggregates known security issues, configuration flaws, and implementation errors discovered in the open-source messaging platform developed by VMware and maintained by the RabbitMQ community. The content encompasses vulnerability records spanning from early releases in 2007 through the latest stable versions released in 2024, ensuring comprehensive historical coverage and up-to-date risk assessment capabilities. Visitors to this resource can track vendor advisories issued by the RabbitMQ project team and official security channels to understand the context and severity of each disclosed issue. Users can also analyze specific weakness classes such as cross-site scripting, injection flaws, or insecure default configurations to comprehend how these generic weaknesses manifest within the RabbitMQ architecture. Furthermore, the page enables users to look up a product's vulnerability history, allowing for the identification of trends, recurring security patterns, and the effectiveness of past mitigation efforts. This structured overview supports security professionals, developers, and system administrators in evaluating the risk posture of their RabbitMQ deployments and prioritizing remediation activities based on verified data rather than speculative reports. By centralizing this information, the page serves as a critical reference for maintaining the integrity and reliability of messaging infrastructure that relies on RabbitMQ for inter-process communication and event-driven architectures.

Vendor: rabbitmq

CVE ID Title CVSS Severity Published
CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only CWE-295 9.1 Critical 2026-09-23
CVE-2026-67218 RabbitMQ: Super-stream HTTP creation skips configure-permission check CWE-862 2.1 Low 2026-09-23
CVE-2026-66074 RabbitMQ: ReDoS via management API ?name= filter CWE-1333 6.0 Medium 2026-09-23
CVE-2026-67232 RabbitMQ: Web-MQTT decompression bomb CWE-409 8.2 High 2026-09-23
CVE-2026-67405 RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) CWE-1385 5.3 Medium 2026-09-23
CVE-2026-66075 RabbitMQ: Monitoring-tag user can restart federation links CWE-862 2.3 Low 2026-09-23
CVE-2026-67219 RabbitMQ: Consistent-hash exchange unbounded weight CWE-770 6.0 Medium 2026-09-23
CVE-2026-67228 RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component CWE-400 6.9 Medium 2026-09-23
CVE-2026-67235 RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size CWE-770 7.1 High 2026-09-23
CVE-2026-66068 RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs CWE-532 5.6 Medium 2026-09-23
CVE-2026-67229 RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata CWE-400 6.9 Medium 2026-09-23
CVE-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation CWE-770 5.9 Medium 2026-09-23
CVE-2026-67240 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard CWE-1333 2.3 Low 2026-09-23
CVE-2026-66072 RabbitMQ: Atom table exhaustion via stream `chunk_selector` CWE-400 6.0 Medium 2026-09-23
CVE-2026-66067 RabbitMQ: Stream protocol skips per vhost per user connection limits CWE-770 6.0 Medium 2026-09-23
CVE-2026-66069 RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics CWE-862 2.3 Low 2026-09-23
CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch CWE-295 9.2 Critical 2026-09-23
CVE-2026-67220 RabbitMQ: JMS topic exchange erl_scan atom exhaustion CWE-400 6.0 Medium 2026-09-23
CVE-2026-67224 RabbitMQ: Admin path-traversal write via trace name CWE-22 2.1 Low 2026-09-23
CVE-2026-66077 RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI CWE-79 7.3 High 2026-09-23
CVE-2026-66079 RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS CWE-770 8.2 High 2026-09-23
CVE-2026-66070 RabbitMQ: CORS * reflects Origin with Allow-Credentials CWE-942 7.6 High 2026-09-23
CVE-2026-67238 RabbitMQ: Atom-table exhaustion via reply-to queue name decoding CWE-400 7.1 High 2026-09-23
CVE-2026-66076 RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure CWE-862 2.3 Low 2026-09-23
CVE-2026-57217 RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass CWE-863 - - 2026-07-10
CVE-2026-57221 RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users CWE-862 - - 2026-07-10
CVE-2026-57215 RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom CWE-863 - - 2026-07-10
CVE-2026-57219 RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations CWE-200 8.7 High 2026-07-10
CVE-2026-57218 RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure CWE-863 - - 2026-07-10
CVE-2026-57216 RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checks CWE-287 6.8 Medium 2026-07-10

All 74 known CVE vulnerabilities affecting rabbitmq-server with full Chinese analysis, references, and POCs where available.