rabbitmq-server
v4.3.7Open source RabbitMQ: core server and tier 1 (built-in) plugins
- Maintenance
- Active1180 commits in 3 months · bus factor 2
- License
- OtherUnknown
- Security
- 30 advisories6 high, 17 medium, 7 low · Scorecard 5.7/10
- Supported versions
- No scheduleendoflife.date does not track this project
14k stars · 4k forks · 277 open issues · last release 26 days ago · data checked 2 hours ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 6 high, 17 medium, 7 low. Check the patched version against the one you run.
- highGHSA-3wxh-g236-vm46Oct 25, 2026LDAP authentication failures allow unauthenticated log amplification
- Affected
- >= 4.3.0, < 4.3.7; >= 4.2.0, < 4.2.12; >= 4.1.0, < 4.1.17; >= 3.13.0, < 3.13.21
- Patched in
- 4.3.7; 4.2.12; 4.1.17; 3.13.21
- mediumGHSA-g73v-gcjq-2g4hOct 25, 2026AMQP message conversion can repeatedly disconnect AMQP 0-9-1 consumers
- Affected
- >= 4.3.0, < 4.3.7; >= 4.2.0, < 4.2.12; >= 4.1.0, < 4.1.17
- Patched in
- 4.3.7; 4.2.12; 4.1.17
- mediumGHSA-6wvj-vwrc-wcrmOct 25, 2026HTML injection in management UI OAuth login warning
- Affected
- >= 3.13.0, < 3.13.21; >= 4.1.0, < 4.1.17; >= 4.2.0, < 4.2.12; >= 4.3.0, < 4.3.7
- Patched in
- 3.13.21; 4.1.17; 4.2.12; 4.3.7
- mediumGHSA-mhh3-4wv2-rrj7Oct 25, 2026SASL credentials are not redacted from `amqp10_client` crash dumps and `sys:get_status` output
- Affected
- >= 4.3.0, < 4.3.7; >= 4.2.0, < 4.2.12; >= 4.1.0, < 4.1.17; >= 3.13.0, < 3.13.21
- Patched in
- 4.3.7; 4.2.12; 4.1.17; 3.13.21
- highGHSA-9h6g-46wc-m2f5Oct 25, 2026Memory DoS via incomplete AMQP 0-9-1 messages
- Affected
- >= 4.3.0, < 4.3.7; >= 4.2.0, < 4.2.12; >= 4.1.0, < 4.1.17; >= 3.13.0, < 3.13.21
- Patched in
- 4.3.7; 4.2.12; 4.1.17; 3.13.21
- mediumGHSA-j6hc-926v-qwq2Sep 18, 2026RabbitMQ STOMP consumers retain OAuth queue access after JWT expiration
- Affected
- >= 4.3.0, < 4.3.6; >= 4.2.0, < 4.2.11
- Patched in
- 4.3.6; 4.2.11
- lowGHSA-6jvc-jx8w-m757Sep 18, 2026RabbitMQ Stream Publisher Management API Discloses Unauthorized Vhost and Stream Existence
- Affected
- >= 4.3.0, < 4.3.6; >= 4.2.0, < 4.2.11
- Patched in
- 4.3.6; 4.2.11
- lowGHSA-342v-cj47-c9g8Sep 18, 2026Cross-vhost Stream consumer virtual-host existence disclosure
- Affected
- >= 4.3.0, < 4.3.6; >= 4.2.0, < 4.2.11
- Patched in
- 4.3.6; 4.2.11
- mediumGHSA-5jgm-jxp7-gwjhSep 18, 2026MQTT retained message store has no size or count limit and is never reclaimed
- Affected
- >= 4.3.0, < 4.3.5
- Patched in
- 4.3.5
- mediumCVE-2026-67421Aug 18, 2026Stored HTML Injection in RabbitMQ Management OAuth Error Handling
- Affected
- >= 3.13.0, < 3.13.19; >= 4.0.0, < 4.0.24; >= 4.1.0, < 4.1.15; >= 4.2.0, < 4.2.10; >= 4.3.0, < 4.3.5
- Patched in
- 3.13.19; 4.0.24; 4.1.15; 4.2.10; 4.3.5
- mediumGHSA-6gmw-wxch-cvvcAug 18, 2026Shovel URI credentials disclosed to read-only monitoring users via the shovel management HTTP API
- Affected
- >= 3.13.0, < 3.13.19; >= 4.0.0, < 4.0.24; >= 4.1.0, < 4.1.15; >= 4.2.0, < 4.2.10; >= 4.3.0, < 4.3.5
- Patched in
- 3.13.19; 4.0.24; 4.1.15; 4.2.10; 4.3.5
- lowGHSA-27gv-h5q6-cpwgAug 18, 2026RabbitMQ policymaker RCE through federation-management nonmember RPC and distribution reflection
- Affected
- >= 3.13.0, < 3.13.19; >= 4.0.0, < 4.0.24; >= 4.1.0, < 4.1.15; >= 4.2.0, < 4.2.10; >= 4.3.0, < 4.3.5
- Patched in
- 3.13.19; 4.0.24; 4.1.15; 4.2.10; 4.3.5
- mediumGHSA-3526-xvv4-q9mrAug 18, 2026RabbitMQ administrator RCE through reflected Erlang distribution authentication
- Affected
- >= 3.13.0, < 3.13.19; >= 4.0.0, < 4.0.24; >= 4.1.0, < 4.1.15; >= 4.2.0, < 4.2.10; >= 4.3.0, < 4.3.5
- Patched in
- 3.13.19; 4.0.24; 4.1.15; 4.2.10; 4.3.5
- mediumGHSA-6xpg-rfmh-grhqAug 18, 2026STOMP pre-authentication frame size limit is not enforced
- Affected
- >= 3.13.0, < 3.13.19; >= 4.0.0, < 4.0.24; >= 4.1.0, < 4.1.15; >= 4.2.0, < 4.2.10; >= 4.3.0, < 4.3.5
- Patched in
- 3.13.19; 4.0.24; 4.1.15; 4.2.10; 4.3.5
- lowGHSA-pj8f-mw2q-3xjjAug 18, 2026RabbitMQ consistent-hash exchange: empty array crashes DLX queue processes
- Affected
- >= 4.2.0, < 4.2.10; >= 4.3.0, < 4.3.5
- Patched in
- 4.2.10; 4.3.5
- lowGHSA-4826-gphh-vw3xAug 18, 2026MQTT 5.0: Receive Maximum zero disables delivery credit
- Affected
- >= 4.2.0, < 4.2.10; >= 4.3.0, < 4.3.5
- Patched in
- 4.2.10; 4.3.5
- mediumGHSA-6chv-gv3h-cvcjAug 18, 2026RabbitMQ direct reply-to: forged suffix fanout causes quadratic mailbox memory
- Affected
- >= 4.2.0, < 4.2.10; >= 4.3.0, < 4.3.5
- Patched in
- 4.2.10; 4.3.5
- highGHSA-cfqc-c682-93mmAug 18, 2026RabbitMQ Web STOMP: compressed pre-authentication messages exhaust broker memory
- Affected
- >= 4.2.0, < 4.2.10; >= 4.3.0, < 4.3.5
- Patched in
- 4.2.10; 4.3.5
- mediumCVE-2026-121714Aug 18, 2026AMQP 1.0 post-body properties bypass user-ID validation and reach consumers
- Affected
- >= 4.3.0, < 4.3.5
- Patched in
- 4.3.5
- lowCVE-2026-67418Aug 18, 2026MQTT 5.0: inapplicable PUBLISH property disconnects matching subscribers
- Affected
- >= 3.13.0, < 3.13.19; >= 4.0.0, < 4.0.24; >= 4.1.0, < 4.1.15; >= 4.2.0, < 4.2.10; >= 4.3.0, < 4.3.5
- Patched in
- 3.13.19; 4.0.24; 4.1.15; 4.2.10; 4.3.5
- lowCVE-2026-67420Aug 18, 2026RabbitMQ OAuth credential refresh retains revoked runtime tags
- Affected
- >= 3.13.0, < 3.13.19; >= 4.0.0, < 4.0.24; >= 4.1.0, < 4.1.15; >= 4.2.0, < 4.2.10; >= 4.3.0, < 4.3.5
- Patched in
- 3.13.19; 4.0.24; 4.1.15; 4.2.10; 4.3.5
- highCVE-2026-67419Aug 18, 2026Consecutive topic wildcards cause combinatorial routing work
- Affected
- >= 4.3.0, < 4.3.5
- Patched in
- 4.3.5
- mediumCVE-2026-67416Jul 23, 2026AMQP 1.0 symbolic body descriptor prefix collisions bypass validation
- Affected
- >= 4.3.0, < 4.3.4; >= 4.2.0, < 4.2.10; >= 4.1.0, < 4.1.15; >= 4.0.0, < 4.0.24
- Patched in
- 4.3.4; 4.2.10; 4.1.15; 4.0.24
- mediumCVE-2026-67414Jul 23, 2026RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation
- Affected
- >= 4.3.0, < 4.3.4; >= 4.2.0, < 4.2.10; >= 4.1.0, < 4.1.15; >= 4.0.0, < 4.0.24
- Patched in
- 4.3.4; 4.2.10; 4.1.15; 4.0.24
- mediumCVE-2026-67415Jul 23, 2026Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service
- Affected
- >= 4.3.0, < 4.3.3; >= 4.2.0, < 4.2.9
- Patched in
- 4.3.3; 4.2.9
- highCVE-2026-67408Jul 23, 2026Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service
- Affected
- >= 4.3.0, < 4.3.3; >= 4.2.0, < 4.2.9; >= 4.1.0, < 4.1.11
- Patched in
- 4.3.3; 4.2.9; 4.1.11
- highCVE-2026-67409Jul 23, 2026JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252)
- Affected
- >= 4.3.0, < 4.3.3; >= 4.2.0, < 4.2.9; >= 4.1.0, < 4.1.14; >= 4.0.0, < 4.0.23; >= 3.13.0, < 3.13.18
- Patched in
- 4.3.3; 4.2.9; 4.1.14; 4.0.23; 3.13.18
- mediumCVE-2026-61837Jul 23, 2026AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks
- Affected
- >= 4.3.0, < 4.3.3; >= 4.2.0, < 4.2.9; >= 4.1.0, < 4.1.14; >= 4.0.0, < 4.0.23
- Patched in
- 4.3.3; 4.2.9; 4.1.14; 4.0.23
- mediumCVE-2026-67226Jul 23, 2026Admin-only atom exhaustion: PUT /api/users tags list
- Affected
- >= 4.0.0, < 4.0.22; >= 4.1.0, < 4.1.14; >= 4.2.0, < 4.2.7
- Patched in
- 4.0.22; 4.1.14; 4.2.7
- mediumCVE-2026-67227Jul 23, 2026Atom exhaustion: to_atom on global-parameter :name
- Affected
- >= 4.0.0, < 4.0.22; >= 4.1.0, < 4.1.14; >= 4.2.0, < 4.2.7; >= 4.3.0, < 4.3.1
- Patched in
- 4.0.22; 4.1.14; 4.2.7; 4.3.1