RA
Product
rabbitmq-server
71
CVEs
0
On KEV
10.0
Max CVSS
3
New 30D
Severity mix
Critical 4High 20Medium 45Low 2
Watch
Add rabbitmq-server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-66070 | 8.8 | Sep 23 | RabbitMQ: CORS * reflects Origin with Allow-Credentials Affected: >= 3.13.0, < 3.13.17; >= 4.0.0, < 4.0.22; >= 4.1.0, < 4.1.13; >= 4.2.0, < 4.2.6 |
| CVE-2026-57215 | 8.8 | Jul 10 | RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom Affected: >= 4.2.0, < 4.2.6; >= 4.1.0, < 4.1.11; >= 4.0.0, < 4.0.21; >= 3.13.0, < 3.13.15 |
| CVE-2026-67405 | 8.1 | Sep 23 | RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) Affected: >= 3.13.0, < 3.13.15; >= 4.0.0, < 4.0.20; >= 4.1.0, < 4.1.11; >= 4.2.0, < 4.2.6 |
| CVE-2026-44838 | 8.1 | May 27 | RabbitMQ MQTT Topic Permission Authorization Bypass Affected: >= 4.2.0, < 4.2.4 |
| CVE-2026-57212 | 7.7 | Jul 10 | RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size Affected: >= 4.2.0, < 4.2.5; >= 4.1.0, < 4.1.10; >= 4.0.0, < 4.0.19; >= 3.13.0, < 3.13.14 |
| CVE-2026-67225 | 7.5 | Sep 25 | RabbitMQ: Stream-protocol frame length never validated against frame_max Affected: >= 3.13.0, < 3.13.15; >= 4.0.0, < 4.0.20; >= 4.1.0, < 4.1.11; >= 4.2.0, < 4.2.6 |
| CVE-2026-67230 | 7.5 | Sep 25 | RabbitMQ: Web-STOMP unbounded pre-auth accumulation Affected: >= 4.2.0, < 4.2.6; >= 4.1.0, < 4.1.11; >= 4.0.0, < 4.0.20; >= 3.13.0, < 3.13.15 |
| CVE-2026-67232 | 7.5 | Sep 23 | RabbitMQ: Web-MQTT decompression bomb Affected: >= 3.13.0, < 3.13.15; >= 4.0.0, < 4.0.20; >= 4.1.0, < 4.1.11; >= 4.2.0, < 4.2.6 |
| CVE-2026-66079 | 7.5 | Sep 23 | RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS Affected: >= 3.13.0, < 3.13.15; >= 4.0.0, < 4.0.20; >= 4.1.0, < 4.1.11; >= 4.2.0, < 4.2.6 |
| CVE-2026-57219 | 7.5 | Jul 10 | RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations Affected: >= 4.2.0, < 4.2.6; >= 4.1.0, < 4.1.11; >= 4.0.0, < 4.0.21; >= 3.13.0, < 3.13.15 |
| CVE-2026-57220 | 7.5 | Jul 10 | RabbitMQ: Stream listener does not enforce configured frame-size limit during authentication, permitting unauth'd mem-exhaust DoS Affected: >= 4.2.0, < 4.2.6 |
| CVE-2022-31008 | 7.5 | Oct 6 | Predictable credential obfuscation seed value used in rabbitmq-server Affected: < 3.8.32; >= 3.9.0, < 3.9.18; >= 3.10.0, < 3.10.2 |
| CVE-2026-67404 | 7.4 | Sep 23 | RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch Affected: >= 3.13.0, < 3.13.15; >= 4.0.0, < 4.0.20; >= 4.1.0, < 4.1.11; >= 4.2.0, < 4.2.6 |
| CVE-2026-67410 | 7.1 | Sep 25 | RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint Affected: >= 4.3.0, < 4.3.3; >= 4.2.0, < 4.2.9 |
| CVE-2026-67407 | 7.1 | Sep 25 | RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass Affected: >= 4.3.2, < 4.3.3; >= 4.2.0, < 4.2.9; >= 4.1.0, < 4.1.14; >= 4.0.0, < 4.0.23 |
| CVE-2026-67411 | 7.1 | Sep 25 | RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass Affected: >= 4.3.0, < 4.3.3; >= 4.2.0, < 4.2.9; >= 4.1.0, < 4.1.14; >= 4.0.0, < 4.0.23; >= 3.13.0, < 3.13.18 |
| CVE-2026-67412 | 7.1 | Sep 25 | RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access Affected: >= 4.3.0, < 4.3.3; >= 4.2.0, < 4.2.9; >= 4.1.0, < 4.1.14; >= 4.0.0, < 4.0.24; >= 3.13.0, < 3.13.18 |
| CVE-2026-67223 | 7.1 | Sep 25 | RabbitMQ: LDAP DN injection via unescaped substitution Affected: >= 3.13.0, < 3.13.18; >= 4.0.0, < 4.0.23; >= 4.1.0, < 4.1.14; >= 4.2.0, < 4.2.9; >= 4.3.0, < 4.3.3 |
| CVE-2026-67233 | 7.1 | Sep 24 | RabbitMQ: Monitoring-tag user can DELETE shovels Affected: >= 3.13.0, < 3.13.15; >= 4.0.0, < 4.0.20; >= 4.1.0, < 4.1.11; >= 4.2.0, < 4.2.6; >= 4.3.0, < 4.3.1 |
| CVE-2026-67238 | 7.1 | Sep 23 | RabbitMQ: Atom-table exhaustion via reply-to queue name decoding Affected: >= 4.2.0, < 4.2.7; >= 4.3.0, < 4.3.1 |
Showing 20