EUVD-2026-93777

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load...

legba

legba Join the project community on our server! Legba is a multiprotocol credentials bruteforcer / password sprayer and enumerator built with Rust and the Tokio asynchronous runtime in order to achieve better performances and stability while consuming less resources than similar tools. Key Featur...

spring-amqp-deserialization

spring-amqp-deserialization Spring AMQP 역직렬화 취약점CVE-2023-34050에 대한 개념 증명PoC 영향받는 버전: 1.0.0 2.4.16 3.0.0 3.0.9 참조: https://spring.io/security/cve-2023-34050...

rabbitmq-c: rabbitmq-c: Heap buffer overflow leading to denial of service

A flaw was found in rabbitmq-c. A malicious AMQP Advanced Message Queuing Protocol server or an on-path attacker can send an undersized frame size during the login handshake. This can lead to a heap buffer overflow, causing memory corruption and potentially a denial of service. Code execution is...

RHEL 8 : librabbitmq (RHSA-2026:75582)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:75582 advisory. The librabbitmq packages provide an Advanced Message Queuing Protocol AMQP client library that allows you to communicate with AMQP servers using...

CVE-2016-2173

CVE-2016-2173 - Spring AMQP 원격 코드 실행 - 앱 테스트 설명 org.springframework.core.serializer.DefaultDeserializer 클래스는 역직렬화된 객체를 화이트리스트에 대해 검증하지 않습니다. Chris Frohoff의 Commons Collection 가젯과 같은 조작된 직렬화 객체를 제공하면 원격 코드 실행이 가능합니다. 영향을 받는 버전 1.0.0 1.5.4 공급업체 Pivotal의 Spring 설치 - Maven 3.x+ - Java 1.7+ - RabbitMQ...

mig

MIG: Mozilla InvestiGator MIG is Mozilla's platform for investigative surgery of remote endpoints. ⚠️ Deprecation Notice ⚠️ Mozilla is no longer maintaining the Mozilla InvestiGator MIG project. Mozilla is also no longer making use of this code internally. You are welcome to use this code as is...

BIT-RABBITMQ-2026-67420 RabbitMQ OAuth credential refresh retains revoked runtime tags

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...

BIT-RABBITMQ-2026-67240 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

BIT-RABBITMQ-2026-67238 RabbitMQ: Atom-table exhaustion via reply-to queue name decoding

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbitpidcodec:decomposefrombinary/1 parses a caller-supplied ETF-encoded binary and calls binarytoatomNode, utf8 on the node-name field. It is reached from rabbitvolatilequeue:pidfromname/2, which is invoked for any...

BIT-RABBITMQ-2026-67221 RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

BIT-RABBITMQ-2026-61837 RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET...

[SECURITY] Fedora 44 Update: librabbitmq-0.18.0-1.fc44

This is a C-language AMQP client library for use with AMQP servers speaking protocol versions 0-9-1...

[SECURITY] Fedora 43 Update: librabbitmq-0.18.0-1.fc43

This is a C-language AMQP client library for use with AMQP servers speaking protocol versions 0-9-1...

This Week in Spring - September 29th, 2026

Hi, Spring fans! Welcome to another rip-roarin' and exciting installment of This Week in Spring! We've got a ton of cool stuff to look at this week, so let's dive right into it! an important update on Spring's release practice Speaking of which, we had a slew of releases on the 24th, including...

SUSE CVE-2026-61837

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET...

SUSE CVE-2026-67420

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...

CVE-2026-92560

A flaw was found in Apache Qpid Broker-J within the Advanced Message Queuing Protocol AMQP 0-10 decoder component. An unauthenticated remote attacker could exploit improper type size and count handling by sending specially crafted network messages. This can trigger excessive memory allocation,...

CVE-2026-92550

A flaw was found in Apache Qpid Broker-J. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted messages with manipulated type size or count parameters to the AMQP Advanced Message Queuing Protocol decoder. This causes excessive memory allocation, leadin...

CVE-2026-67420

A flaw was found in rabbitmq-server. When an existing Advanced Message Queuing Protocol AMQP connection refreshes its authentication token to one with revoked impersonation privileges, the server fails to update the active session's security tags. As a result, an authenticated user can retain...