Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

rabbitmq — Vulnerabilities & Security Advisories 93

Browse all 93 CVE security advisories affecting rabbitmq. AI-powered Chinese analysis, POCs, and references for each vulnerability.

RabbitMQ serves as a widely adopted message broker for enterprise messaging and queuing systems, enabling reliable communication between distributed applications. Historically, it has been susceptible to remote code execution vulnerabilities through deserialization flaws, cross-site scripting in management interfaces, and privilege escalation via authentication bypasses. The platform's default configurations often present attack surfaces, with past incidents including unauthorized access through exposed management consoles and credential stuffing attacks. While RabbitMQ maintains a relatively low CVE count compared to similar systems, its complex architecture requires careful hardening to prevent exploitation of common misconfigurations and access control weaknesses.

Found 74 results / 93 Clear Filters
CVE ID Title CVSS Severity Published
CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only — rabbitmq-server CWE-295 9.1 Critical 2026-09-23
CVE-2026-67218 RabbitMQ: Super-stream HTTP creation skips configure-permission check — rabbitmq-server CWE-862 2.1 Low 2026-09-23
CVE-2026-66074 RabbitMQ: ReDoS via management API ?name= filter — rabbitmq-server CWE-1333 6.0 Medium 2026-09-23
CVE-2026-67232 RabbitMQ: Web-MQTT decompression bomb — rabbitmq-server CWE-409 8.2 High 2026-09-23
CVE-2026-67405 RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) — rabbitmq-server CWE-1385 5.3 Medium 2026-09-23
CVE-2026-66075 RabbitMQ: Monitoring-tag user can restart federation links — rabbitmq-server CWE-862 2.3 Low 2026-09-23
CVE-2026-67219 RabbitMQ: Consistent-hash exchange unbounded weight — rabbitmq-server CWE-770 6.0 Medium 2026-09-23
CVE-2026-67228 RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component — rabbitmq-server CWE-400 6.9 Medium 2026-09-23
CVE-2026-67235 RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size — rabbitmq-server CWE-770 7.1 High 2026-09-23
CVE-2026-66068 RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs — rabbitmq-server CWE-532 5.6 Medium 2026-09-23
CVE-2026-67229 RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata — rabbitmq-server CWE-400 6.9 Medium 2026-09-23
CVE-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation — rabbitmq-server CWE-770 5.9 Medium 2026-09-23
CVE-2026-67240 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard — rabbitmq-server CWE-1333 2.3 Low 2026-09-23
CVE-2026-66072 RabbitMQ: Atom table exhaustion via stream `chunk_selector` — rabbitmq-server CWE-400 6.0 Medium 2026-09-23
CVE-2026-66067 RabbitMQ: Stream protocol skips per vhost per user connection limits — rabbitmq-server CWE-770 6.0 Medium 2026-09-23
CVE-2026-66069 RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics — rabbitmq-server CWE-862 2.3 Low 2026-09-23
CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch — rabbitmq-server CWE-295 9.2 Critical 2026-09-23
CVE-2026-67220 RabbitMQ: JMS topic exchange erl_scan atom exhaustion — rabbitmq-server CWE-400 6.0 Medium 2026-09-23
CVE-2026-67224 RabbitMQ: Admin path-traversal write via trace name — rabbitmq-server CWE-22 2.1 Low 2026-09-23
CVE-2026-66077 RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI — rabbitmq-server CWE-79 7.3 High 2026-09-23
CVE-2026-66079 RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS — rabbitmq-server CWE-770 8.2 High 2026-09-23
CVE-2026-66070 RabbitMQ: CORS * reflects Origin with Allow-Credentials — rabbitmq-server CWE-942 7.6 High 2026-09-23
CVE-2026-67238 RabbitMQ: Atom-table exhaustion via reply-to queue name decoding — rabbitmq-server CWE-400 7.1 High 2026-09-23
CVE-2026-66076 RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure — rabbitmq-server CWE-862 2.3 Low 2026-09-23
CVE-2026-57217 RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass — rabbitmq-server CWE-863 - - 2026-07-10
CVE-2026-57221 RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users — rabbitmq-server CWE-862 - - 2026-07-10
CVE-2026-57215 RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom — rabbitmq-server CWE-863 - - 2026-07-10
CVE-2026-57219 RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations — rabbitmq-server CWE-200 8.7 High 2026-07-10
CVE-2026-57218 RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure — rabbitmq-server CWE-863 - - 2026-07-10
CVE-2026-57216 RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checks — rabbitmq-server CWE-287 6.8 Medium 2026-07-10

This page lists every published CVE security advisory associated with rabbitmq. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.