RS
Product
Rabbitmq Server
74
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 5High 22Medium 45Low 0
Watch
Add Rabbitmq Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-66070 | 8.8 | Sep 23 | RabbitMQ: CORS * reflects Origin with Allow-Credentials Affected: 3.13.0 before 3.13.17; 4.0.0 before 4.0.22; 4.1.0 before 4.1.13; 4.2.0 before 4.2.6 |
| CVE-2026-57215 | 8.8 | Jul 10 | RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom Affected: 3.13.0 before 4.2.6 |
| CVE-2026-67405 | 8.1 | Sep 23 | RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) Affected: 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6 |
| CVE-2026-44838 | 8.1 | May 27 | RabbitMQ MQTT Topic Permission Authorization Bypass Affected: 4.2.0 before 4.2.4 |
| CVE-2021-22117 | 7.8 | May 18 | RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesystem permissions to… Affected: 3.8.0 before 3.8.16 |
| CVE-2017-4966 | 7.8 | Jun 13 | An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all… Affected: 3.4.0; 3.4.1; 3.4.2; 3.4.3; 3.4.4; 3.5.0; +5 more |
| CVE-2026-57212 | 7.7 | Jul 10 | RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size Affected: 3.13.0 before 4.2.5 |
| CVE-2026-67225 | 7.5 | Sep 25 | RabbitMQ: Stream-protocol frame length never validated against frame_max Affected: 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6 |
| CVE-2026-67230 | 7.5 | Sep 25 | RabbitMQ: Web-STOMP unbounded pre-auth accumulation Affected: 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6 |
| CVE-2026-67232 | 7.5 | Sep 23 | RabbitMQ: Web-MQTT decompression bomb Affected: 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6 |
| CVE-2026-66079 | 7.5 | Sep 23 | RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS Affected: 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6 |
| CVE-2026-57219 | 7.5 | Jul 10 | RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations Affected: 3.13.0 before 4.2.6 |
| CVE-2026-57220 | 7.5 | Jul 10 | RabbitMQ: Stream listener does not enforce configured frame-size limit during authentication, permitting unauth'd mem-exhaust DoS Affected: 4.2.0 before 4.2.6 |
| CVE-2022-31008 | 7.5 | Oct 6 | Predictable credential obfuscation seed value used in rabbitmq-server Affected: 3.9.0 before 3.9.18; 3.10.0 before 3.10.2 |
| CVE-2019-11287 | 7.5 | Nov 23 | Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4,… Affected: 3.8.0 before 3.8.1 |
| CVE-2026-67404 | 7.4 | Sep 23 | RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch Affected: 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6 |
| CVE-2026-67410 | 7.1 | Sep 25 | RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint Affected: 4.2.0 before 4.2.9; 4.3.0 before 4.3.3 |
| CVE-2026-67407 | 7.1 | Sep 25 | RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass Affected: 4.0.0 before 4.0.23; 4.1.0 before 4.1.14; 4.2.0 before 4.2.9; 4.3.0 before 4.3.3 |
| CVE-2026-67411 | 7.1 | Sep 25 | RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass Affected: 3.13.0 before 3.13.18; 4.0.0 before 4.0.23; 4.1.0 before 4.1.14; 4.2.0 before 4.2.9; 4.3.0 before 4.3.3 |
| CVE-2026-67412 | 7.1 | Sep 25 | RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access Affected: 3.13.0 before 3.13.18; 4.0.0 before 4.0.24; 4.1.0 before 4.1.14; 4.2.0 before 4.2.9; 4.3.0 before 4.3.3 |
| CVE-2026-67223 | 7.1 | Sep 25 | RabbitMQ: LDAP DN injection via unescaped substitution Affected: 3.13.0 before 3.13.18; 4.0.0 before 4.0.23; 4.1.0 before 4.1.14; 4.2.0 before 4.2.9; 4.3.0 before 4.3.3 |
| CVE-2026-67233 | 7.1 | Sep 24 | RabbitMQ: Monitoring-tag user can DELETE shovels Affected: 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6; 4.3.0 before 4.3.1 |
Showing 22