Rabbitmq Server (Broadcom) - vulnerabilities (CVEs)

74 CVEs, 0 in the last 30 days, 605 known versions, newest CVE from 2026-09-25. Vendor: Broadcom.

CVEs of Rabbitmq Server

• CVE-2026-67420 - CVSS 6.5 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked…
• CVE-2026-67419 - CVSS 7.1 (high), 2026-09-25: RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use…
• CVE-2026-67421 - CVSS 6.8 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP…
• CVE-2026-67408 - CVSS 7.1 (high), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows…
• CVE-2026-67406 - CVSS 6.5 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and…
• CVE-2026-67410 - CVSS 8.2 (high), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint…
• CVE-2026-67227 - CVSS 5.9 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter :name.…
• CVE-2026-67407 - CVSS 7.1 (high), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1…
• CVE-2026-67226 - CVSS 6.9 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2…
• CVE-2026-67411 - CVSS 7.1 (high), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a…
• CVE-2026-67413 - CVSS 6.5 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq_jms_topic_exchange plugin's x-jms-topic…
• CVE-2026-61837 - CVSS 6.3 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding…
• CVE-2026-67415 - CVSS 5.9 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter…
• CVE-2026-67412 - CVSS 7.1 (high), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost…
• CVE-2026-67409 - CVSS 8.2 (high), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code -…
• CVE-2026-67242 - CVSS 6.3 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp.…
• CVE-2026-67223 - CVSS 7.1 (high), 2026-09-25: RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting…
• CVE-2026-67239 - CVSS 7.6 (high), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in…
• CVE-2026-67241 - CVSS 6.5 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission…
• CVE-2026-66071 - CVSS 6.5 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope…
• CVE-2026-66078 - CVSS 5.5 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE…
• CVE-2026-66073 - CVSS 6.5 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field.…
• CVE-2026-67237 - CVSS 9.3 (critical), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or…
• CVE-2026-67234 - CVSS 4.3 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_auth_mechanism or…
• CVE-2026-67225 - CVSS 7.5 (high), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated…
• CVE-2026-67230 - CVSS 7.5 (high), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither…
• CVE-2026-67222 - CVSS 6.5 (medium), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied list_to_atom/1 to every…
• CVE-2026-67236 - CVSS 8.2 (high), 2026-09-25: RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie…
• CVE-2026-67233 - CVSS 7.1 (high), 2026-09-24: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's is_authorized/2…
• CVE-2026-67221 - CVSS 5.9 (medium), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls…
• CVE-2026-67231 - CVSS 9.1 (critical), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that…
• CVE-2026-67218 - CVSS 6.5 (medium), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, accept_content/2 at line 56 calls…
• CVE-2026-66074 - CVSS 6.5 (medium), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name=…
• CVE-2026-67232 - CVSS 8.2 (high), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set…
• CVE-2026-67405 - CVSS 8.1 (high), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler…
• CVE-2026-66075 - CVSS 5.4 (medium), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is_authorized/2 for the…
• CVE-2026-67219 - CVSS 6.5 (medium), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_binding/3 parses the routing key as an integer…
• CVE-2026-67235 - CVSS 7.1 (high), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize (a uint64) was stored…
• CVE-2026-66068 - CVSS 5.6 (medium), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel…
• CVE-2026-67229 - CVSS 6.9 (medium), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_vhost/2 calls…
• CVE-2026-66080 - CVSS 5.9 (medium), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validate_partitions only checks that the requested partition count…
• CVE-2026-66072 - CVSS 6.5 (medium), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the…
• CVE-2026-67404 - CVSS 9.2 (critical), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls…
• CVE-2026-67220 - CVSS 6.5 (medium), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, When a binding is created on an x-jms-topic exchange,…
• CVE-2026-67224 - CVSS 4.9 (medium), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as…
• CVE-2026-66077 - CVSS 7.3 (high), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... %> does…
• CVE-2026-66079 - CVSS 8.2 (high), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0)…
• CVE-2026-66070 - CVSS 8.8 (high), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and…
• CVE-2026-66076 - CVSS 6.5 (medium), 2026-09-23: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls…
• CVE-2026-57217 - CVSS 7 (high), 2026-07-10: RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.21, 4.1.11, and 4.2.6, RabbitMQ topic authorization can allow restricted topic writes and…
• CVE-2026-57221 - CVSS 5.3 (medium), 2026-07-10: RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive…
• CVE-2026-57215 - CVSS 8.8 (high), 2026-07-10: RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to…
• CVE-2026-57219 - CVSS 8.7 (high), 2026-07-10: RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client…
• CVE-2026-57218 - CVSS 6.5 (medium), 2026-07-10: RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token…
• CVE-2026-57216 - CVSS 10 (critical), 2026-07-10: RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow…
• CVE-2026-57220 - CVSS 7.5 (high), 2026-07-10: RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while…
• CVE-2026-57214 - CVSS 7.1 (high), 2026-07-10: RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an…
• CVE-2026-57211 - CVSS 10 (critical), 2026-07-10: RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static…
• CVE-2026-57212 - CVSS 7.7 (high), 2026-07-10: RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON…
• CVE-2026-57213 - CVSS 5.7 (medium), 2026-07-10: RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag…
• CVE-2026-44839 - CVSS 5.6 (medium), 2026-05-27: RabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13, This vulnerability is fixed in 4.1.2 and 4.0.13.
• CVE-2026-44838 - CVSS 8.1 (high), 2026-05-27: RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows for topic-level authorization using regular…
• CVE-2025-50200 - CVSS 6.7 (medium), 2025-06-19: RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When…
• CVE-2022-31008 - CVSS 7.5 (high), 2022-10-06: RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker…
• CVE-2021-22117 - CVSS 7.8 (high), 2021-05-18: RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local…
• CVE-2020-5419 - CVSS 6.7 (medium), 2020-08-31: RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An…
• CVE-2019-11287 - CVSS 7.5 (high), 2019-11-23: Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x…
• CVE-2019-11291 - CVSS 4.8 (medium), 2019-11-22: Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions…
• CVE-2017-4967 - CVSS 6.1 (medium), 2017-06-13: An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for…
• CVE-2017-4966 - CVSS 7.8 (high), 2017-06-13: An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for…
• CVE-2017-4965 - CVSS 6.1 (medium), 2017-06-13: An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for…
• CVE-2016-9877 - CVSS 9.8 (critical), 2016-12-29: An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x…
• CVE-2014-9650 - CVSS 5 (medium), 2015-01-27: CRLF injection vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary HTTP headers…
• CVE-2014-9649 - CVSS 4.3 (medium), 2015-01-27: Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web…