rabbitmq rabbitmq-server

• CVE-2026-67418 Medium 5.3 RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers 0.4%
• CVE-2026-67414 Medium 6.0 RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation 0.6%
• CVE-2026-67416 Medium 5.3 RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation 0.6%
• CVE-2026-67420 Low 2.3 RabbitMQ OAuth credential refresh retains revoked runtime tags 0.3%
• CVE-2026-67419 High 7.1 RabbitMQ: Consecutive topic wildcards cause combinatorial routing work 0.4%
• CVE-2026-67421 Medium 4.5 RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling 0.3%
• CVE-2026-67408 High 7.1 RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service 0.4%
• CVE-2026-67406 Medium 4.6 RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status 0.3%
• CVE-2026-67410 High 8.2 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint 0.4%
• CVE-2026-67227 Medium 5.9 RabbitMQ: Atom exhaustion: to_atom on global-parameter :name 0.4%
• CVE-2026-67407 Medium 5.1 RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass 0.3%
• CVE-2026-67226 Medium 6.9 RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list 0.4%
• CVE-2026-67411 Medium 6.0 RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass 0.3%
• CVE-2026-67413 Medium 6.0 RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression 0.5%
• CVE-2026-61837 Medium 6.3 RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks 0.3%
• CVE-2026-67415 Medium 5.9 RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service 0.4%
• CVE-2026-67412 Medium 6.0 RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access 0.3%
• CVE-2026-67409 High 8.2 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS 0.4%
• CVE-2026-67242 Medium 6.3 RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp 0.3%
• CVE-2026-67223 Medium 6.3 RabbitMQ: LDAP DN injection via unescaped substitution 0.4%
• CVE-2026-67239 High 7.6 RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI 0.2%
• CVE-2026-67241 Medium 4.8 RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check 0.4%
• CVE-2026-66071 Medium 6.0 RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values 0.5%
• CVE-2026-66078 Low 2.1 RabbitMQ: protected tag bypass via bulk-delete 0.4%
• CVE-2026-66073 Medium 6.0 RabbitMQ: Atom table exhaustion via management API node field 0.5%
• CVE-2026-67237 High 7.5 RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint 0.5%
• CVE-2026-67234 Low 2.3 RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference 0.4%
• CVE-2026-67225 Medium 6.3 RabbitMQ: Stream-protocol frame length never validated against frame_max 0.3%
• CVE-2026-67230 Medium 6.3 RabbitMQ: Web-STOMP unbounded pre-auth accumulation 0.6%
• CVE-2026-67222 Medium 5.9 RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client 0.3%
• CVE-2026-67236 High 8.2 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login 0.2%
• CVE-2026-67233 Medium 6.0 RabbitMQ: Monitoring-tag user can DELETE shovels 0.3%
• CVE-2026-67221 Medium 5.9 RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords 0.2%
• CVE-2026-67231 Critical 9.1 RabbitMQ: Trust-store whitelist by Issuer+Serial only 0.2%
• CVE-2026-67218 Low 2.1 RabbitMQ: Super-stream HTTP creation skips configure-permission check 0.4%
• CVE-2026-66074 Medium 6.0 RabbitMQ: ReDoS via management API ?name= filter 0.4%
• CVE-2026-67232 High 8.2 RabbitMQ: Web-MQTT decompression bomb 0.4%
• CVE-2026-67405 Medium 5.3 RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) 0.1%
• CVE-2026-66075 Low 2.3 RabbitMQ: Monitoring-tag user can restart federation links 0.2%
• CVE-2026-67219 Medium 6.0 RabbitMQ: Consistent-hash exchange unbounded weight 0.3%
• CVE-2026-67228 Medium 6.9 RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component 0.3%
• CVE-2026-67235 High 7.1 RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size 0.3%
• CVE-2026-66068 Medium 5.6 RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs 0.1%
• CVE-2026-67229 Medium 6.9 RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata 0.4%
• CVE-2026-66080 Medium 5.9 RabbitMQ: Super-stream partitions unbounded allocation 0.3%
• CVE-2026-67240 Low 2.3 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard 0.4%
• CVE-2026-66072 Medium 6.0 RabbitMQ: Atom table exhaustion via stream `chunk_selector` 0.5%
• CVE-2026-66067 Medium 6.0 RabbitMQ: Stream protocol skips per vhost per user connection limits 0.4%
• CVE-2026-66069 Low 2.3 RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics 0.3%
• CVE-2026-67404 Critical 9.2 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch 0.2%