CVE-2026-67232 affecting package rabbitmq-server for versions less than 3.13.7-10

CVE-2026-67232 affecting package rabbitmq-server for versions less than 3.13.7-10. A patched version of the package is available...

CVE-2026-66072 affecting package rabbitmq-server for versions less than 3.13.7-10

CVE-2026-66072 affecting package rabbitmq-server for versions less than 3.13.7-10. A patched version of the package is available...

CVE-2026-66079 affecting package rabbitmq-server for versions less than 3.13.7-10

CVE-2026-66079 affecting package rabbitmq-server for versions less than 3.13.7-10. A patched version of the package is available...

CVE-2026-67219 affecting package rabbitmq-server for versions less than 3.13.7-10

CVE-2026-67219 affecting package rabbitmq-server for versions less than 3.13.7-10. A patched version of the package is available...

CVE-2026-67234

A flaw was found in rabbitmq-server. When clearing authentication preferences, the server generates a non-compliant cookie name containing invalid characters that standard web browsers reject when attempting deletion. This issue prevents the browser from properly removing the cookie, allowing sta...

CVE-2026-66078

A flaw was found in RabbitMQ. A remote authenticated user with administrative privileges can bypass account deletion safeguards by removing accounts using the bulk-delete API endpoint. Because this endpoint fails to check whether a user account has the protected tag, protected service accounts ca...

CVE-2026-67413

A flaw was found in rabbitmq-server. An authenticated user with permissions to bind and publish messages can cause a Denial of Service DoS by submitting specially crafted pattern-matching expressions to the Java Message Service JMS topic exchange plugin. Because the message broker evaluates these...

CVE-2026-67407

A flaw was found in rabbitmq-server. Due to improper regular expression character escaping, topic permission templates for Message Queuing Telemetry Transport MQTT clients fail to sanitize hyphen characters. An authenticated, low-privileged attacker controlling their client identifier can exploit...

CVE-2026-67239

A flaw was found in rabbitmq-server. The stream-management interface fails to properly sanitize peer certificate fields, leading to a stored Cross-Site Scripting XSS vulnerability. A remote attacker with a valid Transport Layer Security TLS certificate containing a crafted Distinguished Name DN c...

CVE-2026-67237

A flaw was found in rabbitmq-server. When Open Authorization OAuth is enabled for the management interface, the application fails to properly sanitize authentication tokens before embedding them into the bootstrap script. A remote attacker could exploit this cross-site scripting XSS vulnerability...

CVE-2026-67227

A flaw was found in rabbitmq-server. An authenticated remote user with policymaker privileges can cause a Denial of Service DoS by sending repeated HTTP requests with unique parameter names to the global parameters API endpoint. Because user-supplied parameter names are unsafely converted into...

CVE-2026-67230

A flaw was found in RabbitMQ. When the Web STOMP plugin is enabled, the WebSocket handler fails to enforce maximum frame size limits or login timeouts prior to client authentication. An unauthenticated remote attacker can exploit this vulnerability by sending a continuous stream of small frames t...

CVE-2026-67226

A flaw was found in rabbitmq-server. An authenticated user with administrative privileges can cause a Denial of Service DoS by submitting user definitions containing an excessive number of unique tag names. Because the application converts each tag string into an internal Erlang identifier that...

CVE-2026-67225

A flaw was found in rabbitmq-server. The stream protocol fails to validate the declared length of incoming frames against the negotiated maximum frame size before buffering them into memory. When the stream plugin is enabled, a remote attacker can exploit this issue by declaring an oversized fram...

CVE-2026-67223

A flaw was found in rabbitmq-server. When the service uses the Lightweight Directory Access Protocol LDAP authentication plugin with a configured user Distinguished Name DN pattern, it fails to properly escape special characters in the username. A remote attacker can exploit this vulnerability by...

CVE-2026-67222

A flaw was found in rabbitmq-server. An authenticated remote attacker with policymaker privileges can exploit this issue when the Shovel or Federation plugin is enabled by supplying a specially crafted authentication mechanism value. This causes the server to permanently exhaust Erlang virtual...

CVE-2026-66073

A flaw was found in rabbitmq-server. An authenticated user with management API access can cause a Denial of Service DoS by sending requests containing arbitrary node names to queue, exchange, or binding endpoints. Because untrusted input is converted into internal system identifiers atoms without...

CVE-2026-61837

A flaw was found in RabbitMQ. The Advanced Message Queuing Protocol AMQP 1.0 management interface fails to perform proper authorization checks when processing requests for message bindings. An authenticated user without administrative privileges can exploit this issue to enumerate the complete...

CVE-2026-67421

A flaw was found in rabbitmq-server. When the Open Authorization OAuth management interface is enabled, error messages fail to properly sanitize queue names and render them as raw HTML. An authenticated attacker with queue configuration permissions can create a queue name containing malicious HTM...

CVE-2026-67418

A flaw was found in rabbitmq-server. An authenticated user with message publishing permissions can transmit a specially crafted Message Queuing Telemetry Transport MQTT message containing an invalid property. When the broker forwards this message, an unhandled exception terminates the recipient's...