RS
Product
Rabbitmq Server
74
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 5High 22Medium 45Low 0
Watch
Add Rabbitmq Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-4967 | 6.1 | Jun 13 | An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all… Affected: 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.4.4; 3.5.0; +5 more |
| CVE-2017-4965 | 6.1 | Jun 13 | An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all… Affected: 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.4.4; 3.5.0; +5 more |
| CVE-2026-66078 | 5.5 | Sep 25 | RabbitMQ: protected tag bypass via bulk-delete Affected: 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6 |
| CVE-2025-50200 | 5.5 | Jun 19 | RabbitMQ is a messaging and streaming broker Affected: before 4.0.8 |
| CVE-2026-67242 | 5.4 | Sep 25 | RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp Affected: 4.2.0 before 4.2.9; 4.3.0 before 4.3.3 |
| CVE-2026-67239 | 5.4 | Sep 25 | RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI Affected: 3.13.0 before 3.13.18; 4.0.0 before 4.0.23; 4.1.0 before 4.1.14; 4.2.0 before 4.2.9; 4.3.0 before 4.3.3 |
| CVE-2026-66075 | 5.4 | Sep 23 | RabbitMQ: Monitoring-tag user can restart federation links Affected: 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6; 4.3.0 before 4.3.1 |
| CVE-2026-57214 | 5.4 | Jul 10 | RabbitMQ: Stored XSS in RabbitMQ management UI Affected: 4.2.0 before 4.2.5 |
| CVE-2026-61837 | 5.3 | Sep 25 | RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks Affected: 4.0.0 before 4.0.23; 4.1.0 before 4.1.14; 4.2.0 before 4.2.9; 4.3.0 before 4.3.3 |
| CVE-2026-57221 | 5.0 | Jul 10 | RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users Affected: 3.13.0 before 4.2.6 |
| CVE-2026-67227 | 4.9 | Sep 25 | RabbitMQ: Atom exhaustion: to_atom on global-parameter :name Affected: 4.0.0 before 4.0.22; 4.1.0 before 4.1.14; 4.2.0 before 4.2.7; 4.3.0 before 4.3.1 |
| CVE-2026-67226 | 4.9 | Sep 25 | RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list Affected: 4.0.0 before 4.0.22; 4.1.0 before 4.1.14; 4.2.0 before 4.2.7 |
| CVE-2026-67415 | 4.9 | Sep 25 | RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service Affected: 4.2.0 before 4.2.9; 4.3.0 before 4.3.3 |
| CVE-2026-67221 | 4.9 | Sep 23 | RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords Affected: 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6 |
| CVE-2026-67229 | 4.9 | Sep 23 | RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata Affected: 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6 |
| CVE-2026-66080 | 4.9 | Sep 23 | RabbitMQ: Super-stream partitions unbounded allocation Affected: 4.1.0 before 4.1.11; 4.2.0 before 4.2.6 |
| CVE-2026-67224 | 4.9 | Sep 23 | RabbitMQ: Admin path-traversal write via trace name Affected: 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6; 4.3.0 before 4.3.1 |
| CVE-2026-57213 | 4.8 | Jul 10 | RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering Affected: 3.13.0 before 4.2.5 |
| CVE-2026-44839 | 4.8 | May 27 | RabbitMQ: Unsanitized vhost names allow for XSS in management UI Affected: 3.7.0 before 4.0.13; 4.1.0 before 4.1.2 |
| CVE-2019-11291 | 4.8 | Nov 22 | Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain… Affected: 3.7.0 before 3.7.20; 3.8.0 |
| CVE-2026-66068 | 4.4 | Sep 23 | RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs Affected: 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6 |
| CVE-2026-67234 | 4.3 | Sep 25 | RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference Affected: 4.2.0 before 4.2.8; 4.3.0 before 4.3.2 |
| CVE-2014-9650 | – | Jan 27 | CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP… Affected: 2.1.0; 2.1.1; 2.2.0; 2.3.0; 2.3.1; 2.4.0; +34 more |
| CVE-2014-9649 | – | Jan 27 | Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via… Affected: 2.1.0; 2.1.1; 2.2.0; 2.3.0; 2.3.1; 2.4.0; +34 more |