Vulnerability · Published Oct 24, 2023 · Assigned by GitHub_M
CVE-2023-46118Denial of Service by publishing large messages over the HTTP API
Medium 4.9
In plain English
A medium-severity uncontrolled resource consumption in rabbitmq-server from rabbitmq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rabbitmq-server | 3.10.8-1.1+deb12u1 | DSA-5571-1 |
| Debian:12 | rabbitmq-server | 3.10.8-1.1+deb12u1 | DEBIAN-CVE-2023-46118 |
| Debian:13 | rabbitmq-server | 3.10.8-3 | DEBIAN-CVE-2023-46118 |
| Debian:14 | rabbitmq-server | 3.10.8-3 | DEBIAN-CVE-2023-46118 |
| Ubuntu:22.04:LTS | rabbitmq-server | 3.9.13-1ubuntu0.22.04.2 | USN-6501-1 |
| Ubuntu:22.04:LTS | rabbitmq-server | 3.9.13-1ubuntu0.22.04.2 | UBUNTU-CVE-2023-46118 |
| Ubuntu:24.04:LTS | rabbitmq-server | 3.12.1-1ubuntu1 | UBUNTU-CVE-2023-46118 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rabbitmq | rabbitmq-server | < 3.12.7< 3.11.24 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H