Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

rabbitmq — Vulnerabilities & Security Advisories 93

Browse all 93 CVE security advisories affecting rabbitmq. AI-powered Chinese analysis, POCs, and references for each vulnerability.

RabbitMQ serves as a widely adopted message broker for enterprise messaging and queuing systems, enabling reliable communication between distributed applications. Historically, it has been susceptible to remote code execution vulnerabilities through deserialization flaws, cross-site scripting in management interfaces, and privilege escalation via authentication bypasses. The platform's default configurations often present attack surfaces, with past incidents including unauthorized access through exposed management consoles and credential stuffing attacks. While RabbitMQ maintains a relatively low CVE count compared to similar systems, its complex architecture requires careful hardening to prevent exploitation of common misconfigurations and access control weaknesses.

CVE ID Title CVSS Severity Published
CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only — rabbitmq-server CWE-295 9.1 Critical 2026-09-23
CVE-2026-67218 RabbitMQ: Super-stream HTTP creation skips configure-permission check — rabbitmq-server CWE-862 2.1 Low 2026-09-23
CVE-2026-66074 RabbitMQ: ReDoS via management API ?name= filter — rabbitmq-server CWE-1333 6.0 Medium 2026-09-23
CVE-2026-67232 RabbitMQ: Web-MQTT decompression bomb — rabbitmq-server CWE-409 8.2 High 2026-09-23
CVE-2026-67405 RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) — rabbitmq-server CWE-1385 5.3 Medium 2026-09-23
CVE-2026-66075 RabbitMQ: Monitoring-tag user can restart federation links — rabbitmq-server CWE-862 2.3 Low 2026-09-23
CVE-2026-67219 RabbitMQ: Consistent-hash exchange unbounded weight — rabbitmq-server CWE-770 6.0 Medium 2026-09-23
CVE-2026-67228 RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component — rabbitmq-server CWE-400 6.9 Medium 2026-09-23
CVE-2026-67235 RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size — rabbitmq-server CWE-770 7.1 High 2026-09-23
CVE-2026-66068 RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs — rabbitmq-server CWE-532 5.6 Medium 2026-09-23
CVE-2026-67229 RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata — rabbitmq-server CWE-400 6.9 Medium 2026-09-23
CVE-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation — rabbitmq-server CWE-770 5.9 Medium 2026-09-23
CVE-2026-67240 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard — rabbitmq-server CWE-1333 2.3 Low 2026-09-23
CVE-2026-66072 RabbitMQ: Atom table exhaustion via stream `chunk_selector` — rabbitmq-server CWE-400 6.0 Medium 2026-09-23
CVE-2026-66067 RabbitMQ: Stream protocol skips per vhost per user connection limits — rabbitmq-server CWE-770 6.0 Medium 2026-09-23
CVE-2026-66069 RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics — rabbitmq-server CWE-862 2.3 Low 2026-09-23
CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch — rabbitmq-server CWE-295 9.2 Critical 2026-09-23
CVE-2026-67220 RabbitMQ: JMS topic exchange erl_scan atom exhaustion — rabbitmq-server CWE-400 6.0 Medium 2026-09-23
CVE-2026-67224 RabbitMQ: Admin path-traversal write via trace name — rabbitmq-server CWE-22 2.1 Low 2026-09-23
CVE-2026-66077 RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI — rabbitmq-server CWE-79 7.3 High 2026-09-23
CVE-2026-66079 RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS — rabbitmq-server CWE-770 8.2 High 2026-09-23
CVE-2026-66070 RabbitMQ: CORS * reflects Origin with Allow-Credentials — rabbitmq-server CWE-942 7.6 High 2026-09-23
CVE-2026-67238 RabbitMQ: Atom-table exhaustion via reply-to queue name decoding — rabbitmq-server CWE-400 7.1 High 2026-09-23
CVE-2026-66076 RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure — rabbitmq-server CWE-862 2.3 Low 2026-09-23
CVE-2026-75516 RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement — rabbitmq-java-client CWE-770 8.7 High 2026-09-16
CVE-2026-77409 RabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel Blocking — amqp091-go CWE-770 8.2 High 2026-09-16
CVE-2026-77411 RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr — amqp091-go CWE-754 9.5 Critical 2026-09-16
CVE-2026-77412 RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client — amqp091-go CWE-681 8.9 High 2026-09-16
CVE-2026-77405 RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser — amqp091-go CWE-326 9.4 Critical 2026-09-16
CVE-2026-77404 RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection — amqp091-go CWE-116 8.7 High 2026-09-16

This page lists every published CVE security advisory associated with rabbitmq. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.