CVE-2026-67240

Prior to versions 4.2.7 and 4.3.1 , RabbitMQ is vulnerable to a backtracking-driven CPU amplification (ReDoS) attack. The issue occurs because pattern_to_regex maps wildcards to regex patterns that, when combined with overlapping lazy quantifiers, cause high CPU usage. Specifically, SQL filters a...

CVE-2026-67240

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

CVE-2026-67240 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

CVE-2026-66072 RabbitMQ: Atom table exhaustion via stream `chunk_selector`

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, getchunkselector/1 calls binarytoatom on the raw client-supplied property from post-auth subscribe and resolveoffsetspec frames, with no whitelist and no existing guard. An authenticated...

CVE-2026-66072

RabbitMQ, a messaging and streaming broker, is vulnerable to atom table exhaustion in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1. The get_chunk_selector/1 function fails to validate raw client-supplied chunk_selector properties from post-auth subscribe and resolve_offset_spec fra...

EUVD-2026-85634

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, getchunkselector/1 calls binarytoatom on the raw client-supplied property from post-auth subscribe and resolveoffsetspec frames, with no whitelist and no existing guard. An authenticated...

CVE-2026-66072

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, getchunkselector/1 calls binarytoatom on the raw client-supplied property from post-auth subscribe and resolveoffsetspec frames, with no whitelist and no existing guard. An authenticated...

CVE-2026-66067 RabbitMQ: Stream protocol skips per vhost per user connection limits

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges th...

CVE-2026-66067 RabbitMQ: Stream protocol skips per vhost per user connection limits

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges th...

CVE-2026-66067

Prior to versions 4.2.7 and 4.3.1 , RabbitMQ fails to correctly enforce per-user and per-virtual host (vhost) connection limits within its stream protocol handler. While the handler performs check_vhost_access, it omits the connection-limit checks used for AMQP, a gap explicitly acknowledged in t...

EUVD-2026-85633

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges th...

CVE-2026-66067 RabbitMQ: Stream protocol skips per vhost per user connection limits

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The stream open handler calls only checkvhostaccess; it omits the node/vhost/user connection-limit checks that rabbitreader performs for AMQP. A developer %% FIXME comment at the cited line explicitly acknowledges th...

undici: undici: Denial of Service via unhandled error in WebSocket permessage-deflate decompression

A flaw was found in undici. A remote, unauthenticated attacker can trigger a Denial of Service DoS by sending a specially crafted compressed WebSocket payload. When this payload exceeds the 128 MiB decompressed-payload limit and contains a malformed DEFLATE byte, it causes an unhandled error in t...

CVE-2026-75935

A flaw was found in Amazon ion-java. This uncontrolled memory allocation vulnerability in the binary Ion stream cursor allows remote attackers to cause a denial of service DoS by sending a specially crafted Ion binary document. The crafted document contains a declared-length field that triggers...

php: PHP: Denial of Service via reserved device names on Windows

A flaw was found in PHP. When running on Windows environments, PHP's filesystem and stream handlers fail to reject reserved system device names in file paths. An attacker who can control file or stream paths can supply these reserved names to open system devices instead of standard files. This ca...

php: php: Credential disclosure via cross-origin HTTP redirects

A flaw was found in PHP. When following a redirect, the built-in HTTP Hypertext Transfer Protocol stream wrapper forwards sensitive request headers—such as authentication tokens and session cookies—unchanged, even when directed to a different host, port, or unencrypted connection. A malicious...

php: php: Information disclosure via out-of-bounds read in stream filters

A flaw was found in PHP. When processing certain conversion stream filters with line-break settings containing a null byte, the filter duplicates the string but retains the original length rather than the truncated size. An attacker who can influence filter options could exploit this out-of-bound...

php: php: Out-of-bounds read via empty HTTP redirect Location header

A flaw was found in PHP. When the HTTP stream wrapper processes a redirect response containing an empty Location header, an out-of-bounds read occurs by accessing memory beyond the allocated buffer. A malicious server can exploit this flaw to influence the client's redirect target path, potential...

SUSE CVE-2026-63274

LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stream read and wrote past the end of the...

PT-2026-97563

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An issue exists in the validate partitions function where it only verifies that the requested partition count is at least 1, withou...