CVE-2026-66068

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOGDEBUG"shutting down Shovel 'ts', ... Shovel state: tp", Name, State formats the entire state map. The 'uris' field holds plaintext URIs after credentialsobfuscation:decrypt called in...

CVE-2026-66068

The RabbitMQ messaging and streaming broker contains a vulnerability in the Shovel plugin prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. When DEBUG logging is enabled, the system fails to redact the uris field during the completion of an autodelete shovel (src-delete-after = N). Spe...

CVE-2026-66068 RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOGDEBUG"shutting down Shovel 'ts', ... Shovel state: tp", Name, State formats the entire state map. The 'uris' field holds plaintext URIs after credentialsobfuscation:decrypt called in...

CVE-2026-66068 RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOGDEBUG"shutting down Shovel 'ts', ... Shovel state: tp", Name, State formats the entire state map. The 'uris' field holds plaintext URIs after credentialsobfuscation:decrypt called in...

CVE-2026-66068 RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOGDEBUG"shutting down Shovel 'ts', ... Shovel state: tp", Name, State formats the entire state map. The 'uris' field holds plaintext URIs after credentialsobfuscation:decrypt called in...

EUVD-2026-85651

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOGDEBUG"shutting down Shovel 'ts', ... Shovel state: tp", Name, State formats the entire state map. The 'uris' field holds plaintext URIs after credentialsobfuscation:decrypt called in...

CVE-2026-67229

RabbitMQ, a messaging and streaming broker, is vulnerable to a Denial of Service (DoS) condition in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. The add_vhost/2 function calls the unsafe rabbit_data_coercion:atomize_keys/1 variant using binary_to_atom on the vhost metadata map. An...

CVE-2026-67229 RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addvhost/2 calls rabbitdatacoercion:atomizekeys/1 the unsafe variant using binarytoatom on the vhost metadata map. The 20 MB management body limit fits 1M+ short keys. Admin-only. An...

CVE-2026-67229 RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addvhost/2 calls rabbitdatacoercion:atomizekeys/1 the unsafe variant using binarytoatom on the vhost metadata map. The 20 MB management body limit fits 1M+ short keys. Admin-only. An...

CVE-2026-67229

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addvhost/2 calls rabbitdatacoercion:atomizekeys/1 the unsafe variant using binarytoatom on the vhost metadata map. The 20 MB management body limit fits 1M+ short keys. Admin-only. An...

CVE-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

CVE-2026-66080

The messaging broker RabbitMQ is vulnerable to an unbounded memory allocation issue in the validate_partitions function. Prior to versions 4.1.11, 4.2.6, and 4.3.0 , the system fails to enforce an upper bound on the requested partition count, allowing a large count (e.g., 500,000,000) to allocate...

CVE-2026-66080

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

CVE-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

CVE-2026-67240

Prior to versions 4.2.7 and 4.3.1 , RabbitMQ is vulnerable to a backtracking-driven CPU amplification (ReDoS) attack. The issue occurs because pattern_to_regex maps wildcards to regex patterns that, when combined with overlapping lazy quantifiers, cause high CPU usage. Specifically, SQL filters a...

CVE-2026-67240

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

CVE-2026-67240 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

CVE-2026-67240 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

CVE-2026-66076

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, isauthorized/2 calls rabbitmgmtutil:isauthorized/2, which checks only the management tag, instead of isauthorizedvhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost...

DEBIAN-CVE-2026-66076

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, isauthorized/2 calls rabbitmgmtutil:isauthorized/2, which checks only the management tag, instead of isauthorizedvhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost...