1617 matches found
CLEANSTART-2026-LO51673 Security fixes for CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-61731, CVE-2025-61732, CVE-2025-68119, CVE-2025-68121, CVE-2026-25679, CVE-2026-27139, CVE-2026-27140, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144, CVE-2026-27145, CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288, CVE-2026-32289, CVE-2026-33811, CVE-2026-33814, CVE-2026-35469, CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39821, CVE-2026-39823, CVE-2026-39824, CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501, CVE-2026-42502, CVE-2026-42504, CVE-2026-42506, CVE-2026-42507, ghsa-pc3f-x583-g7j2 applied in versions: 2.18.0-r0
Multiple security vulnerabilities affect the rabbitmq-cluster-operator package. These issues are resolved in later releases. See references for individual vulnerability details...
CLEANSTART-2026-DV05833 Security fixes for CVE-2026-42504 applied in versions: 2.21.0-r0
Security vulnerability affects the rabbitmq-cluster-operator package. This issue is resolved in later releases. See references for vulnerability details...
ANT-2026-D7FC4YDQ · rabbitmq-c · Heap-buffer-overflow
heap-buffer-overflow high Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Opus 4.6 REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-D7FC4YDQ: Heap-buffer-overflow in rabbitmq-c libFuzz...
rabbitmq-server: RabbitMQ: Authorization bypass via regular expression injection in MQTT client ID
A flaw was found in RabbitMQ. An authenticated MQTT Message Queuing Telemetry Transport user can bypass topic-level authorization by injecting regular expression operators. This occurs because the client ID, provided by the user in the MQTT CONNECT packet, is inserted into authorization regex...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rabbitmq-server4.2: rabbitmq-server4.2-4.2.9-0.1.hum1 aarch64, x8664 rabbitmq-server4.2-4.2.9-0.1.hum1.src src...
RabbitMQ 3.13.x < 3.13.15 / 4.0.x < 4.0.20 / 4.1.x < 4.1.11 / 4.2.x < 4.2.6 AMQP Authorization Bypass
The version of RabbitMQ installed on the remote host is affected by multiple vulnerabilities: - RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks,...
RabbitMQ 4.2.x < 4.2.6 OAuth Token Expiry Consumer Bypass
The version of RabbitMQ installed on the remote host is 4.2.x prior to 4.2.6. It is, therefore, affected by an authorization bypass vulnerability: - RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.updatesecret refresh to reduced...
RabbitMQ 3.7.x < 4.0.13 / 4.1.x < 4.1.2 XSS via Virtual Host Names
The version of RabbitMQ installed on the remote host is affected by a cross-site scripting vulnerability: - Unsanitized virtual host names allow for XSS in the management UI pages that list virtual hosts if the attacker manages to find a way to force a virtual host to restart. CVE-2026-44839 Note...
RabbitMQ 3.13.x < 3.13.15 / 4.0.x < 4.0.20 / 4.1.x < 4.1.11 / 4.2.x < 4.2.6 Multiple Vulnerabilities
The version of RabbitMQ installed on the remote host is affected by multiple vulnerabilities: - AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the...
RabbitMQ 4.1.x < 4.1.11 / 4.2.x < 4.2.6 UNC Path Injection (Windows)
The version of RabbitMQ installed on the remote Windows host is affected by a vulnerability: - On Windows, the RabbitMQ management plugin static file handler rabbitmgmtwmstatic can pass URL-encoded backslashes to erlprimloader:readfileinfo before path validation when multiple management extension...
RabbitMQ 3.13.x < 3.13.15 / 4.0.x < 4.0.21 / 4.1.x < 4.1.11 / 4.2.x < 4.2.6 Topic Authorization Bypass
The version of RabbitMQ installed on the remote host is affected by an authorization bypass vulnerability: - RabbitMQ topic authorization can allow restricted topic writes and binds during metadata-store failures because topic-permission lookup errors from Khepri can collapse to undefined, which...
RabbitMQ < 4.2.6 Stream Protocol Frame Size DoS
The version of RabbitMQ installed on the remote host is affected by a denial of service vulnerability: - The RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remo...
RabbitMQ 3.13.x < 3.13.14 / 4.0.x < 4.0.19 / 4.1.x < 4.1.10 / 4.2.x < 4.2.5 Multiple Vulnerabilities
The version of RabbitMQ installed on the remote host is affected by multiple vulnerabilities: - The rabbitmqmanagement HTTP API accepts oversized valid JSON bodies on withdecode and directrequest paths because readcompletebody checks the accumulated size before the final chunk but not the final...
RabbitMQ 4.2.x < 4.2.4 MQTT Topic Authorization Bypass
The version of RabbitMQ installed on the remote host is 4.2.x prior to 4.2.4. It is, therefore, affected by an authorization bypass vulnerability: - RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions with variable substitution. However, the clientid is provided ...
RabbitMQ 4.2.x < 4.2.5 XSS via x-internal-purpose Argument
The version of RabbitMQ installed on the remote host is 4.2.x prior to 4.2.5. It is, therefore, affected by a cross-site scripting vulnerability: - The RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queu...
RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom
...
RabbitMQ: UNC SSRF affecting the management UI on Windows
...
RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checks
...