rabbitmq-server: RabbitMQ: Unauthorized cross-vhost message access via missing Federation upstream authorization

A flaw was found in RabbitMQ. The Federation feature fails to enforce virtual host vhost authorization checks when validating upstream connections. An authenticated user with policy configuration privileges in one vhost can exploit this flaw by targeting another vhost where they lack permissions...

rabbitmq: RabbitMQ: Denial of Service via unbounded consistent-hash exchange weight

A flaw was found in RabbitMQ. A user with write permission on a consistent-hash exchange and read on a queue can create a binding with an arbitrarily large integer as its routing key, which acts as a hash-ring weight. This unbounded weight causes the broker to allocate a significant amount of...

rabbitmq: rabbitmq_web_mqtt: RabbitMQ Web-MQTT plugin: Denial of Service via decompression bomb

A flaw was found in the rabbitmqwebmqtt plugin of RabbitMQ. An unauthenticated remote attacker can exploit a decompression bomb vulnerability by sending a highly-compressed WebSocket frame. This frame, when decompressed, inflates to gigabytes of memory, leading to a Denial of Service DoS by...

rabbitmq-server: RabbitMQ: Denial of Service via AMQP 0-9-1 body size validation bypass

A flaw was found in RabbitMQ. An authenticated AMQP 0-9-1 client with publish permissions can exploit a vulnerability in the body assembly process. By declaring an extremely large BodySize and streaming message fragments, the client can bypass size validation, leading to unbounded memory...

rabbitmq-server: RabbitMQ: Cross-Origin Resource Sharing (CORS) misconfiguration allows unauthorized actions

A flaw was found in RabbitMQ. When the management plugin is configured with a wildcard Cross-Origin Resource Sharing CORS origin, it incorrectly reflects the attacker's origin and allows credentials. This vulnerability enables a malicious web page to leverage a signed-in administrator's cached...

rabbitmq-server: RabbitMQ: Monitoring user can reset authentication attempt counters

A flaw was found in RabbitMQ. A user with a monitoring tag, when the Management plugin is enabled, can reset the per-node authentication-attempt counters. This action, which should be restricted to administrators, allows the monitoring-tagged user to erase evidence of brute-force login attempts...

rabbitmq-server: RabbitMQ: Monitoring user can disrupt message flow via authorization flaw

A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker with monitoring user credentials can exploit an authorization flaw to restart federation links. This unauthorized action disrupts message flow, leading to a denial of service DoS for affected services. This...

RabbitMQ: RabbitMQ: Denial of Service via admin-only atom exhaustion from crafted vhost metadata

A flaw was found in RabbitMQ, a messaging and streaming broker. An administrator with appropriate privileges can trigger a Denial of Service DoS by importing a specially crafted definitions file. This file, containing a large number of unique metadata keys, causes the system to exhaust its atom...

rabbitmq: RabbitMQ: Administrator path traversal allows arbitrary file write

A flaw was found in RabbitMQ, a messaging and streaming broker. A user with administrator privileges could exploit a path traversal vulnerability in the tracing plugin. By manipulating the name parameter, an attacker could write a .log-suffixed file to arbitrary filesystem paths writable by the...

rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing

A flaw was found in RabbitMQ. An unauthenticated network attacker can exploit an issue in the AMQP 1.0 listener by sending a specially crafted 19-byte frame. This causes the system to attempt to build a list of approximately 4 billion empty elements, exhausting heap memory and terminating the...

rabbitmq-server: RabbitMQ: Denial of Service via unbounded super-stream partition allocation

A flaw was found in RabbitMQ. A highly privileged remote attacker, with the rabbitmqstreammanagement plugin enabled and access to the target vhost, can exploit an unbounded allocation vulnerability in the super-stream partitions. This allows the attacker to allocate a large amount of memory,...

rabbitmq-server: RabbitMQ: Privilege escalation via super-stream HTTP creation

A flaw was found in RabbitMQ. A user with management tag and virtual host vhost access, but lacking configure permissions, can exploit a vulnerability in the HTTP API for super-stream creation. This flaw allows the user to bypass permission checks and create persistent cluster-wide resources, suc...

RabbitMQ: RabbitMQ: Account takeover via stored Cross-Site Scripting in TLS peer-certificate DN

A flaw was found in RabbitMQ. This vulnerability, a stored Cross-Site Scripting XSS, exists in the management UI. An attacker who can obtain a trusted TLS client certificate can embed malicious JavaScript in the certificate's Subject Distinguished Name DN. When the TLS listener is configured for...

rabbitmq-server: RabbitMQ: Denial of Service via JMS topic exchange atom exhaustion

A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated low-privilege AMQP Advanced Message Queuing Protocol user can exploit this vulnerability by creating bindings on an x-jms-topic exchange with specially crafted selector strings. This action causes an exhaustion of...

rabbitmq: RabbitMQ: Information disclosure of AMQP 1.0 shovel URI passwords

A flaw was found in RabbitMQ, a messaging and streaming broker. The AMQP 1.0 shovel component incorrectly stores connection Uniform Resource Identifiers URIs with embedded plaintext passwords. This information can be exposed to an authenticated attacker with monitoring privileges via the...

rabbitmq-server: RabbitMQ: Denial of Service due to atom-table exhaustion via reply-to queue name decoding

A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated AMQP Advanced Message Queuing Protocol client can trigger an atom-table exhaustion by sending specially crafted reply-to queue names for decoding. This can lead to the entire Erlang Virtual Machine VM crashing,...

rabbitmq: RabbitMQ: Denial of Service via atom exhaustion in runtime-parameter component

A flaw was found in RabbitMQ. An authorized policymaker can exploit this vulnerability by issuing a large number of requests with distinct component values to the runtime-parameters lookup path. This action coerces attacker-supplied strings into new atoms, eventually exhausting the Erlang atom...

rabbitmq-server: RabbitMQ: Cross-Site WebSocket Hijacking via missing Origin header validation

A flaw was found in RabbitMQ's Web-MQTT and Web-STOMP handlers. These handlers do not properly validate the Origin header during a WebSocket upgrade. When specific non-default configurations are enabled, such as usehttpauth=true for Web-STOMP or sslcertlogin=true for both plugins, an attacker can...

rabbitmq: RabbitMQ: Information disclosure of decrypted Shovel URIs in debug logs

A flaw was found in RabbitMQ, a messaging and streaming broker. When the Shovel plugin is enabled with URI-embedded credentials and debug logging is active, the completion of an autodelete shovel can cause decrypted AMQP Advanced Message Queuing Protocol URIs, including usernames and passwords, t...

rabbitmq: RabbitMQ: Information disclosure via cross-vhost authorization bypass

A flaw was found in RabbitMQ. An authorization bypass vulnerability allows a management-tagged user to read Raft status, including leader, members, term, and commit index, for quorum queues in inaccessible virtual hosts vhosts. This exposes sensitive cross-tenant queue names and cluster topology...