Affected: Bitnami: rabbitmq

RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11.

RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11.

rabbitmq-server: RabbitMQ: Unsanitized vhost names allow for XSS in management UI rabbitmq: RabbitMQ: Authenticated user can bypass connection limits via stream protocol rabbitmq: RabbitMQ: Information disclosure of decrypted Shovel URIs in debug logs rabbitmq-server: RabbitMQ: Monitoring user can reset authentication attempt counters rabbitmq-server: RabbitMQ: Cross-Origin Resource Sharing (CORS) misconfiguration allows unauthorized actions rabbitmq-server: rabbitmq-server: Denial of service via atom exhaustion in OAuth2 JWT scope parsing rabbitmq-server: RabbitMQ: Denial of Service via atom table exhaustion in stream chunk_selector rabbitmq: RabbitMQ: Denial of Service via management API regular expression filter rabbitmq-server: RabbitMQ: Monitoring user can disrupt message flow via authorization flaw rabbitmq: RabbitMQ: Information disclosure via cross-vhost authorization bypass RabbitMQ: RabbitMQ: Account takeover via stored Cross-Site Scripting in TLS peer-certificate DN rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing rabbitmq-server: RabbitMQ: Denial of Service via unbounded super-stream partition allocation rabbitmq-server: RabbitMQ: Privilege escalation via super-stream HTTP creation rabbitmq: RabbitMQ: Denial of Service via unbounded consistent-hash exchange weight rabbitmq-server: RabbitMQ: Denial of Service via JMS topic exchange atom exhaustion rabbitmq: RabbitMQ: Information disclosure of AMQP 1.0 shovel URI passwords rabbitmq: RabbitM…

Affected: Ubuntu:Pro:16.04:LTS: rabbitmq-server, Ubuntu:18.04:LTS: rabbitmq-server, Ubuntu:20.04:LTS: rabbitmq-server, Ubuntu:22.04:LTS: rabbitmq-server, Ubuntu:24.04:LTS: rabbitmq-server, Ubuntu:26.04:LTS: rabbitmq-server

RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11.