Login Request a demo
Medium severity · published Oct 25, 2023
CVE-2023-46118
RabbitMQ is a multi-protocol messaging and streaming broker
4.9
CVSS
1.3%
EPSS
No
On KEV
Description
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rabbitmq · Vmware
before 3.11.24; 3.12.0 before 3.12.7 · source: NVD
Affected product
RA
Rabbitmq
Vmware
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-46118
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-46118
Vendor Advisory
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg
lists.debian.org
https://lists.debian.org/debian-lts-announce/2023/12/msg00009.html
www.debian.org
https://www.debian.org/security/2023/dsa-5571
More from Rabbitmq
7.5
CVE-2022-31008
Predictable credential obfuscation seed value used in rabbitmq-server
7.5
CVE-2021-22116
RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint
5.4
CVE-2021-32718
RabbitMQ is a multi-protocol messaging broker
4.8
CVE-2021-32719
RabbitMQ is a multi-protocol messaging broker
4.8
CVE-2019-11291
Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain…