rabbitmq

Products

Exploited and recent CVEs

• CVE-2026-67418 Medium 5.3 RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers 0.4%
• CVE-2026-67414 Medium 6.0 RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation 0.6%
• CVE-2026-67416 Medium 5.3 RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation 0.6%
• CVE-2026-107386 Medium 6.3 amqp091-go: Pre-negotiation frame limit is not enforced to 4KB 0.5%
• CVE-2026-106123 Medium 5.7 RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() 0.2%
• CVE-2026-106122 Medium 6.0 RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers 0.5%
• CVE-2026-106121 Medium 4.9 RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS 0.5%
• CVE-2026-67420 Low 2.3 RabbitMQ OAuth credential refresh retains revoked runtime tags 0.3%
• CVE-2026-67419 High 7.1 RabbitMQ: Consecutive topic wildcards cause combinatorial routing work 0.4%
• CVE-2026-67421 Medium 4.5 RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling 0.3%
• CVE-2026-67408 High 7.1 RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service 0.4%
• CVE-2026-67406 Medium 4.6 RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status 0.3%
• CVE-2026-67410 High 8.2 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint 0.4%
• CVE-2026-67227 Medium 5.9 RabbitMQ: Atom exhaustion: to_atom on global-parameter :name 0.4%
• CVE-2026-67407 Medium 5.1 RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass 0.3%
• CVE-2026-67226 Medium 6.9 RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list 0.4%
• CVE-2026-67411 Medium 6.0 RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass 0.3%
• CVE-2026-67413 Medium 6.0 RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression 0.5%
• CVE-2026-61837 Medium 6.3 RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks 0.3%
• CVE-2026-67415 Medium 5.9 RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service 0.4%
• CVE-2026-67412 Medium 6.0 RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access 0.3%
• CVE-2026-67409 High 8.2 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS 0.4%
• CVE-2026-67242 Medium 6.3 RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp 0.3%
• CVE-2026-67223 Medium 6.3 RabbitMQ: LDAP DN injection via unescaped substitution 0.4%
• CVE-2026-67239 High 7.6 RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI 0.2%
• CVE-2026-67241 Medium 4.8 RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check 0.4%
• CVE-2026-66071 Medium 6.0 RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values 0.5%
• CVE-2026-66078 Low 2.1 RabbitMQ: protected tag bypass via bulk-delete 0.4%
• CVE-2026-66073 Medium 6.0 RabbitMQ: Atom table exhaustion via management API node field 0.5%
• CVE-2026-67237 High 7.5 RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint 0.5%