CVE-2026-63337

A flaw was found in the RabbitMQ Java client library. A remote attacker, by intercepting or answering a JsonRpcClient request, could provide a malicious javaReturnType value. This unvalidated input is then used in Class.forName, allowing the attacker to load an arbitrary class already present in...

CVE-2026-61634

A flaw was found in the RabbitMQ Java client library. A malicious or compromised broker can send a method frame larger than the negotiated Advanced Message Queuing Protocol AMQP framemax value. This inconsistent validation causes the client to allocate and decode a protocol-invalid frame, leading...

ROOT-APP-GOBINARY-CVE-2026-79921 CVE-2026-79921 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-79921 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77410 CVE-2026-77410 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77410 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77406 CVE-2026-77406 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77406 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77407 CVE-2026-77407 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77407 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77411 CVE-2026-77411 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77411 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77404 CVE-2026-77404 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77404 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77405 CVE-2026-77405 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77405 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77412 CVE-2026-77412 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77412 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77403 CVE-2026-77403 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77403 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2026-77408 CVE-2026-77408 in github.com/rabbitmq/amqp091-go - Patched by Root

Root has patched CVE-2026-77408 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...

CLEANSTART-2026-TR09708 Security fix for ghsa-8wmf-6v46-5gfg applied in: rabbitmq-cluster-operator 2.21.1-r6

Security vulnerability affects the rabbitmq-cluster-operator package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-105051

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse array primitive/2 for constructor 0x45 list0 returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times...

PT-2026-105064

RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize a uint64 was stored without validation against max message size. The size check ran only when assembly completed. By declaring body size = 2^63-1 and then streami...

PT-2026-97576

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.1 Description An authorization flaw exists in the...

CVE-2026-66077: Improper Neutralization of Input During Web Page Generation

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which does NOT HTML-escape. connection.ejs:135 renders and peercertissuer directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The...

PT-2026-105042

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify fun that overrides bad cert, unknown ca / bad cert, selfsigned peer when the presented cert "matches" a whitelisted one. The match key is extract...

PT-2026-97561

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 Description The management UI fails to HTML-escape data rendered via EJS 1.0. Specifically, the...

PT-2026-105050

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp uri:remove credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GE...