RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling

RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution

RabbitMQ OAuth credential refresh retains revoked runtime tags

RabbitMQ: Consecutive topic wildcards cause combinatorial routing work

RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service

RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status

RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression

RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS

RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check

RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values

RabbitMQ: Atom table exhaustion via management API node field

RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client

RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login

RabbitMQ: Super-stream HTTP creation skips configure-permission check

RabbitMQ: ReDoS via management API ?name= filter

RabbitMQ: Consistent-hash exchange unbounded weight

RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size

RabbitMQ: Atom table exhaustion via stream `chunk_selector`

RabbitMQ: JMS topic exchange erl_scan atom exhaustion

RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure

RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass

RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure

RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all…

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all…

RabbitMQ: protected tag bypass via bulk-delete

RabbitMQ is a messaging and streaming broker

RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp

RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI

RabbitMQ: Monitoring-tag user can restart federation links

RabbitMQ: Stored XSS in RabbitMQ management UI

RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks

RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users

RabbitMQ: Atom exhaustion: to_atom on global-parameter :name

RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list

RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service

RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords

RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata

RabbitMQ: Super-stream partitions unbounded allocation

RabbitMQ: Admin path-traversal write via trace name

RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering

RabbitMQ: Unsanitized vhost names allow for XSS in management UI

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain…

RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs

RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference