Unscored severity · published Jan 27, 2015
CVE-2014-9650
CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP…
–
CVSS
2.6%
EPSS
No
On KEV
Description
CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the download parameter to api/definitions.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RS
Rabbitmq Server · Broadcom
2.1.0; 2.1.1; 2.2.0; 2.3.0; 2.3.1; 2.4.0; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-9650
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-9650
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2016-0308.html
Mailing List
http://www.openwall.com/lists/oss-security/2015/01/21/13
Vendor Advisory
http://www.rabbitmq.com/release-notes/README-3.4.1.txt
www.securityfocus.com
http://www.securityfocus.com/bid/76091
groups.google.com
https://groups.google.com/forum/#%21topic/rabbitmq-users/-3Z2FyGtXhs
More from Rabbitmq Server
10.0
CVE-2026-57216
RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checks
10.0
CVE-2026-57211
RabbitMQ: UNC SSRF affecting the management UI on Windows
9.8
CVE-2016-9877
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7
9.3
CVE-2026-67237
RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint
9.1
CVE-2026-67231
RabbitMQ: Trust-store whitelist by Issuer+Serial only