Rabbitmq vulnerabilities
100 CVEs and advisories name Rabbitmq as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-67234RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference
- CVE-2026-67225RabbitMQ: Stream-protocol frame length never validated against frame_max
- CVE-2026-67230RabbitMQ: Web-STOMP unbounded pre-auth accumulation
- CVE-2026-67222RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client
- CVE-2026-67236RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
- CVE-2026-67233RabbitMQ: Monitoring-tag user can DELETE shovels
- CVE-2026-67221RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords
- CVE-2026-67231RabbitMQ: Trust-store whitelist by Issuer+Serial only
- CVE-2026-67218RabbitMQ: Super-stream HTTP creation skips configure-permission check
- CVE-2026-66074RabbitMQ: ReDoS via management API ?name= filter
- CVE-2026-67232RabbitMQ: Web-MQTT decompression bomb
- CVE-2026-67405RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)
- CVE-2026-66075RabbitMQ: Monitoring-tag user can restart federation links
- CVE-2026-67219RabbitMQ: Consistent-hash exchange unbounded weight
- CVE-2026-67228RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component
- CVE-2026-67235RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size
- CVE-2026-66068RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs
- CVE-2026-67229RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata
- CVE-2026-66080RabbitMQ: Super-stream partitions unbounded allocation
- CVE-2026-67240RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard
- CVE-2026-66072RabbitMQ: Atom table exhaustion via stream `chunk_selector`
- CVE-2026-66067RabbitMQ: Stream protocol skips per vhost per user connection limits
- CVE-2026-66069RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics
- CVE-2026-67404RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
- CVE-2026-67220RabbitMQ: JMS topic exchange erl_scan atom exhaustion
- CVE-2026-67224RabbitMQ: Admin path-traversal write via trace name
- CVE-2026-66077RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI
- CVE-2026-66079RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS
- CVE-2026-66070RabbitMQ: CORS * reflects Origin with Allow-Credentials
- CVE-2026-67238RabbitMQ: Atom-table exhaustion via reply-to queue name decoding