662 matches found
EUVD-2026-66847
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...
CVE-2026-59271
Spring AMQP (versions 2.4.18 and earlier, 3.2.0–3.2.12, 4.0.0–4.0.4, and 4.1.0) is affected by an information disclosure vulnerability. When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext within the BrokerNotAliveException message, potentiall...
EUVD-2026-66826
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single 1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...
CVE-2026-47860
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single 1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...
PT-2026-82544
Name of the Vulnerable Software and Affected Versions Spring AMQP version 4.1.0 Spring AMQP versions 4.0.0 through 4.0.4 Spring AMQP versions 3.2.0 through 3.2.12 Spring AMQP versions 2.4.18 and earlier Description Applications that send logs to RabbitMQ over TLS using the Log4j2 appender are...
PT-2026-82416
Name of the Vulnerable Software and Affected Versions Spring AMQP version 4.1.0 Spring AMQP versions 4.0.0 through 4.0.4 Spring AMQP versions 3.2.0 through 3.2.12 Spring AMQP versions 2.4.18 and earlier Description A single hostile AMQP message can cause the entire consumer JVM to terminate via a...
CVE-2026-79921
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a comprom...
Linux Distros Unpatched Vulnerability : CVE-2026-79921
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process...
CVE-2026-47860 Unbounded decompression of attacker-supplied compressed message bodies
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single 1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...
CVE-2026-47860
CVE-2026-47860 affects Spring AMQP and stems from unbounded decompression of attacker-supplied compressed message bodies. An attacker with the ability to publish to a queue consumed by an application with message decompression enabled can crash the consumer JVM using a single message of approxima...
AZL-98201 CVE-2026-79921 affecting package keda 2.14.1-16
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-layer denial ...
AZL-98214 CVE-2026-79921 affecting package telegraf 1.31.0-28
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-layer denial ...
DEBIAN-CVE-2026-79921
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-layer denial ...
CVE-2026-79921 amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-layer denial ...
CVE-2026-79921
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-layer denial ...
CVE-2026-79921
amqp091-go is a Go client library for the AMQP 0-9-1 protocol. Before v1.13.0 , a compromised or malicious AMQP broker can force the client to allocate and process content body frames that exceed the negotiated frame_max limit, bypassing the protocol's built-in framing constraints. This leads to ...
PT-2026-82354
An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single 1 MB message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...
CVE-2026-67591
A flaw was found in Apache Qpid ProtonJ2. An authenticated attacker can exploit this vulnerability by exceeding the session flow control incoming window. This can lead to a denial of service DoS, making the system unavailable to legitimate users. Mitigation Ensure authenticated access to AMQP...
CVE-2026-66275
A flaw was found in Apache Qpid Proton-J. An authenticated attacker could exploit this by exceeding the session flow control incoming window. This action could lead to a denial of service DoS, making the system unavailable to legitimate users. Mitigation Ensure authenticated access to AMQP...
