Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
1601 vulnerabilities by Broadcom
CVE-2026-67421 (GCVE-0-2026-67421)
Vulnerability from nvd – Published: 2026-09-25 16:39 – Updated: 2026-09-25 19:58
VLAI
EPSS
VEX
Title
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling
Summary
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 19:57 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 3.13.0, < 3.13.19
Affected: >= 4.0.0, < 4.0.24 Affected: >= 4.1.0, < 4.1.15 Affected: >= 4.2.0, < 4.2.10 Affected: >= 4.3.0, < 4.3.5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67421",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T19:57:04.069632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T19:58:22.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6256-27fm-4rgr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.13.0, \u003c 3.13.19"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.0.24"
},
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.1.15"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.10"
},
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim\u0027s Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:39:02.323Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6256-27fm-4rgr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6256-27fm-4rgr"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/ff595eaaa6d4f580f72fa04801ffd35f48c46027",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/ff595eaaa6d4f580f72fa04801ffd35f48c46027"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5"
}
],
"source": {
"advisory": "GHSA-6256-27fm-4rgr",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-67421",
"datePublished": "2026-09-25T16:39:02.323Z",
"dateReserved": "2026-07-29T15:02:20.412Z",
"dateUpdated": "2026-09-25T19:58:22.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67412 (GCVE-0-2026-67412)
Vulnerability from nvd – Published: 2026-09-25 16:20 – Updated: 2026-09-25 16:45
VLAI
EPSS
VEX
Title
RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access
Summary
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost reads and drains messages out of another vhost it has no permission on. With the default ack-mode the source messages are consumed (deleted), not copied. Why that should not 1. Federation validates the upstream URI without any vhost-access Cross-vhost message read/drain from a per-vhost policymaker, breaking vhost tenancy This issue is fixed in versions 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 16:44 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 4.3.0, < 4.3.3
Affected: >= 4.2.0, < 4.2.9 Affected: >= 4.1.0, < 4.1.14 Affected: >= 4.0.0, < 4.0.24 Affected: >= 3.13.0, < 3.13.18 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67412",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T16:44:37.491195Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:45:00.348Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-42pc-678q-v8qj"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.3"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.9"
},
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.1.14"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.0.24"
},
{
"status": "affected",
"version": "\u003e= 3.13.0, \u003c 3.13.18"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost reads and drains messages out of another vhost it has no permission on. With the default ack-mode the source messages are consumed (deleted), not copied. Why that should not 1. Federation validates the upstream URI without any vhost-access Cross-vhost message read/drain from a per-vhost policymaker, breaking vhost tenancy This issue is fixed in versions 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:20:13.605Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-42pc-678q-v8qj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-42pc-678q-v8qj"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3"
}
],
"source": {
"advisory": "GHSA-42pc-678q-v8qj",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-67412",
"datePublished": "2026-09-25T16:20:13.605Z",
"dateReserved": "2026-07-29T15:02:20.412Z",
"dateUpdated": "2026-09-25T16:45:00.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67411 (GCVE-0-2026-67411)
Vulnerability from nvd – Published: 2026-09-25 16:26 – Updated: 2026-09-25 16:55
VLAI
EPSS
VEX
Title
RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass
Summary
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopback_users, causing the frontend-to-broker address to be treated as loopback. An attacker who can reach the trusted frontend and has valid credentials for a loopback-restricted account can therefore bypass the source-address restriction; the issue does not bypass password authentication. This issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 16:55 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 4.3.0, < 4.3.3
Affected: >= 4.2.0, < 4.2.9 Affected: >= 4.1.0, < 4.1.14 Affected: >= 4.0.0, < 4.0.23 Affected: >= 3.13.0, < 3.13.18 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67411",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T16:55:11.064286Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:55:42.722Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-4r6f-9cpw-f6g6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.3"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.9"
},
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.1.14"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.0.23"
},
{
"status": "affected",
"version": "\u003e= 3.13.0, \u003c 3.13.18"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopback_users, causing the frontend-to-broker address to be treated as loopback. An attacker who can reach the trusted frontend and has valid credentials for a loopback-restricted account can therefore bypass the source-address restriction; the issue does not bypass password authentication. This issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:26:33.880Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-4r6f-9cpw-f6g6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-4r6f-9cpw-f6g6"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/a7528314840c4f8dc9904684f9f97ffa7aac6349",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/a7528314840c4f8dc9904684f9f97ffa7aac6349"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/edbead0eabbd65925d0dc914a22d6a29e155e646",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/edbead0eabbd65925d0dc914a22d6a29e155e646"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3"
}
],
"source": {
"advisory": "GHSA-4r6f-9cpw-f6g6",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-67411",
"datePublished": "2026-09-25T16:26:33.880Z",
"dateReserved": "2026-07-29T15:02:20.412Z",
"dateUpdated": "2026-09-25T16:55:42.722Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67410 (GCVE-0-2026-67410)
Vulnerability from nvd – Published: 2026-09-25 16:32 – Updated: 2026-09-25 17:46
VLAI
EPSS
VEX
Title
RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint
Summary
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecret configuration value is included in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. Any user who can reach the management UI port can retrieve the OAuth2 client secret without Files: deps/rabbitmqmanagement/src/rabbitmgmtwmauth.erl, line 186 deps/rabbitmqmanagement/src/rabbitmgmtoauthbootstrap.erl, lines 35-50 deps/rabbitmqmanagement/src/rabbitmgmtdispatcher.erl, lines 45-49 (route registration) Code Path: 1. The route /js/oidc-oauth/bootstrap.js is registered as a plain Cowboy handler (rabbitmgmtdispatcher.erl:46): Credential exposure for the affected configuration: OAuth2 client secret is accessible without any authentication Token theft: Attacker can complete the authorization code flow using stolen authorization codes Client impersonation: Attacker can make requests. Any RabbitMQ deployment with: This issue is fixed in versions 4.3.3 and 4.2.9.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 17:45 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 4.3.0, < 4.3.3
Affected: >= 4.2.0, < 4.2.9 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67410",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T17:45:46.514401Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T17:46:42.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.3"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecret configuration value is included in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. Any user who can reach the management UI port can retrieve the OAuth2 client secret without Files: deps/rabbitmqmanagement/src/rabbitmgmtwmauth.erl, line 186 deps/rabbitmqmanagement/src/rabbitmgmtoauthbootstrap.erl, lines 35-50 deps/rabbitmqmanagement/src/rabbitmgmtdispatcher.erl, lines 45-49 (route registration) Code Path: 1. The route /js/oidc-oauth/bootstrap.js is registered as a plain Cowboy handler (rabbitmgmtdispatcher.erl:46): Credential exposure for the affected configuration: OAuth2 client secret is accessible without any authentication Token theft: Attacker can complete the authorization code flow using stolen authorization codes Client impersonation: Attacker can make requests. Any RabbitMQ deployment with: This issue is fixed in versions 4.3.3 and 4.2.9."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:32:51.225Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f9f2-q3jf-wfj3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f9f2-q3jf-wfj3"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/60a85d3605ebf94fd234497242812547d441d457",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/60a85d3605ebf94fd234497242812547d441d457"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/869f800998334bb363f2ad046f58de9caedc409e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/869f800998334bb363f2ad046f58de9caedc409e"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3"
}
],
"source": {
"advisory": "GHSA-f9f2-q3jf-wfj3",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-67410",
"datePublished": "2026-09-25T16:32:51.225Z",
"dateReserved": "2026-07-29T15:02:20.412Z",
"dateUpdated": "2026-09-25T17:46:42.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67409 (GCVE-0-2026-67409)
Vulnerability from nvd – Published: 2026-09-25 16:18 – Updated: 2026-09-25 17:49
VLAI
EPSS
VEX
Title
RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS
Summary
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252). the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code when downloading signing keys from the OAuth2 provider's JWKS endpoint. Non-200 responses (including 4xx and 5xx errors) are processed identically to successful responses. When the JWKS endpoint returns an error response with a valid-JSON body that lacks a keys field, all previously cached signing keys are destroyed, causing a persistent authentication denial of Files: deps/rabbitmqauthbackendoauth2/src/uaajwt.erl, lines 50-63 deps/rabbitmqauthbackendoauth2/src/uaajwks.erl, lines 5-7 deps/rabbitmqauthbackendoauth2/src/rabbitoauth2provider.erl, lines 98-107 Bug 1: HTTP status code ignored (uaajwt.erl:50-63): The Erlang httpc module returns {ok, {{HttpVersion, StatusCode, ReasonPhrase}, Headers, Body}}. The pattern {ok, {, , JwksBody}} matches ANY successful HTTP transaction Persistent authentication DoS: Once keys are destroyed, ALL OAuth2/JWT authentication fails for all users until a new successful JWKS refresh occurs Amplification: A single attacker can deny access to all legitimate OAuth2 users across the entire RabbitMQ. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 17:49 UTC
CWE
- CWE-252 - Unchecked Return Value
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 4.3.0, < 4.3.3
Affected: >= 4.2.0, < 4.2.9 Affected: >= 4.1.0, < 4.1.14 Affected: >= 4.0.0, < 4.0.23 Affected: >= 3.13.0, < 3.13.18 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67409",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T17:49:17.770463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T17:49:48.064Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qw3h-qqm9-jrw8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.3"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.9"
},
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.1.14"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.0.23"
},
{
"status": "affected",
"version": "\u003e= 3.13.0, \u003c 3.13.18"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252). the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code when downloading signing keys from the OAuth2 provider\u0027s JWKS endpoint. Non-200 responses (including 4xx and 5xx errors) are processed identically to successful responses. When the JWKS endpoint returns an error response with a valid-JSON body that lacks a keys field, all previously cached signing keys are destroyed, causing a persistent authentication denial of Files: deps/rabbitmqauthbackendoauth2/src/uaajwt.erl, lines 50-63 deps/rabbitmqauthbackendoauth2/src/uaajwks.erl, lines 5-7 deps/rabbitmqauthbackendoauth2/src/rabbitoauth2provider.erl, lines 98-107 Bug 1: HTTP status code ignored (uaajwt.erl:50-63): The Erlang httpc module returns {ok, {{HttpVersion, StatusCode, ReasonPhrase}, Headers, Body}}. The pattern {ok, {, , JwksBody}} matches ANY successful HTTP transaction Persistent authentication DoS: Once keys are destroyed, ALL OAuth2/JWT authentication fails for all users until a new successful JWKS refresh occurs Amplification: A single attacker can deny access to all legitimate OAuth2 users across the entire RabbitMQ. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252: Unchecked Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:18:25.611Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qw3h-qqm9-jrw8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qw3h-qqm9-jrw8"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3"
}
],
"source": {
"advisory": "GHSA-qw3h-qqm9-jrw8",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-67409",
"datePublished": "2026-09-25T16:18:25.611Z",
"dateReserved": "2026-07-29T15:02:20.412Z",
"dateUpdated": "2026-09-25T17:49:48.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67408 (GCVE-0-2026-67408)
Vulnerability from nvd – Published: 2026-09-25 16:35 – Updated: 2026-09-25 19:09
VLAI
EPSS
VEX
Title
RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service
Summary
RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 19:09 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 4.3.0, < 4.3.3
Affected: >= 4.2.0, < 4.2.9 Affected: >= 4.1.0, < 4.1.11 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67408",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T19:09:46.402384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T19:09:53.750Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.3"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.9"
},
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:35:22.829Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/0f3defd176e027f54f447beee168d906d4f109b6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/0f3defd176e027f54f447beee168d906d4f109b6"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/eb11bc44005fd6d327a78bf171bc598207778c9b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/eb11bc44005fd6d327a78bf171bc598207778c9b"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3"
}
],
"source": {
"advisory": "GHSA-2hm4-4438-49q8",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-67408",
"datePublished": "2026-09-25T16:35:22.829Z",
"dateReserved": "2026-07-29T15:02:20.411Z",
"dateUpdated": "2026-09-25T19:09:53.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66073 (GCVE-0-2026-66073)
Vulnerability from nvd – Published: 2026-09-25 16:06 – Updated: 2026-09-25 16:43
VLAI
EPSS
VEX
Title
RabbitMQ: Atom table exhaustion via management API node field
Summary
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name (and the exchanges and bindings endpoints) accepts a node JSON field. The value goes through rabbitnodes:make → listtoatom with no cluster membership check first. Each unique value permanently leaks one atom. A March 2026 refactoring (ea61ce2563) introduced safe helpers in rabbitmgmtnodes.erl (parsenodename, safeatom, and requirenodename, using binarytoexistingatom) and fixed several callers (QQ replica ops, wmauthattempts, wmnodememoryets, getsortreverse, and rabbitfederationmgmt), but getnode/1 in rabbitmgmtutil.erl:880-885, the primary vector used by directrequest/6, was not Roughly 900K requests crash the VM via systemlimit, and all tenants lose Any user with the management tag and one vhost, the lowest privilege This issue is fixed in versions 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 16:43 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 3.13.0, < 3.13.15
Affected: >= 4.0.0, < 4.0.20 Affected: >= 4.1.0, < 4.1.11 Affected: >= 4.2.0, < 4.2.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66073",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T16:43:02.733440Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:43:12.504Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.13.0, \u003c 3.13.15"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.0.20"
},
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.1.11"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name (and the exchanges and bindings endpoints) accepts a node JSON field. The value goes through rabbitnodes:make \u2192 listtoatom with no cluster membership check first. Each unique value permanently leaks one atom. A March 2026 refactoring (ea61ce2563) introduced safe helpers in rabbitmgmtnodes.erl (parsenodename, safeatom, and requirenodename, using binarytoexistingatom) and fixed several callers (QQ replica ops, wmauthattempts, wmnodememoryets, getsortreverse, and rabbitfederationmgmt), but getnode/1 in rabbitmgmtutil.erl:880-885, the primary vector used by directrequest/6, was not Roughly 900K requests crash the VM via systemlimit, and all tenants lose Any user with the management tag and one vhost, the lowest privilege This issue is fixed in versions 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:06:20.501Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6v53-r759-jrvx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6v53-r759-jrvx"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/7f64311471840e68f8cae09e4d4fdc4c8aca9229",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/7f64311471840e68f8cae09e4d4fdc4c8aca9229"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
}
],
"source": {
"advisory": "GHSA-6v53-r759-jrvx",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: Atom table exhaustion via management API node field"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66073",
"datePublished": "2026-09-25T16:06:20.501Z",
"dateReserved": "2026-07-23T23:25:28.897Z",
"dateUpdated": "2026-09-25T16:43:12.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59316 (GCVE-0-2026-59316)
Vulnerability from nvd – Published: 2026-08-27 18:04 – Updated: 2026-08-28 22:47
VLAI
EPSS
VEX
Title
Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
Summary
Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user.
Spring Authorization Server 1.5.0 - 1.5.8
Spring Authorization Server 1.4.0 - 1.4.11
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 22:43 UTC
CWE
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring Authorization Server |
Affected:
1.5.0 , ≤ 1.5.8
(custom)
Affected: 1.4.0 , ≤ 1.4.11 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59316",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T22:43:12.525554Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T22:47:16.884Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring Authorization Server",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "1.5.8",
"status": "affected",
"version": "1.5.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.4.11",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSpring Authorization Server\u0027s default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user.\u003c/p\u003e\u003cp\u003eSpring Authorization Server 1.5.0 - 1.5.8\u003cbr/\u003eSpring Authorization Server 1.4.0 - 1.4.11\u003c/p\u003e"
}
],
"value": "Spring Authorization Server\u0027s default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user.\nSpring Authorization Server 1.5.0 - 1.5.8\nSpring Authorization Server 1.4.0 - 1.4.11"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Spring Authorization Server\u0027s default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T18:04:44.963Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59316"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59316",
"datePublished": "2026-08-27T18:04:44.963Z",
"dateReserved": "2026-07-04T18:13:57.026Z",
"dateUpdated": "2026-08-28T22:47:16.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59284 (GCVE-0-2026-59284)
Vulnerability from nvd – Published: 2026-08-27 17:57 – Updated: 2026-08-28 18:32
VLAI
EPSS
VEX
Title
Spring Cloud Commons no allow list for writable env actuator endpoint
Summary
There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.
Spring Cloud Commons 5.0.0 - 5.0.2
Spring Cloud Commons 4.3.0 - 4.3.3
Spring Cloud Commons 4.0.0 - 4.2.6
Spring Cloud Commons 3.1.10 and earlier
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 18:28 UTC
CWE
- CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring Cloud Commons |
Affected:
5.0.0 , ≤ 5.0.2
(custom)
Affected: 4.3.0 , ≤ 4.3.3 (custom) Affected: 4.0.0 , ≤ 4.2.6 (custom) Affected: 0 , ≤ 3.1.10 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59284",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T18:28:29.044888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T18:32:18.345Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring Cloud Commons",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "5.0.2",
"status": "affected",
"version": "5.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.3.3",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.2.6",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.1.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.\u003c/p\u003e\u003cp\u003eSpring Cloud Commons 5.0.0 - 5.0.2\u003cbr/\u003eSpring Cloud Commons 4.3.0 - 4.3.3\u003cbr/\u003eSpring Cloud Commons 4.0.0 - 4.2.6\u003cbr/\u003eSpring Cloud Commons 3.1.10 and earlier\u003c/p\u003e"
}
],
"value": "There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.\nSpring Cloud Commons 5.0.0 - 5.0.2\nSpring Cloud Commons 4.3.0 - 4.3.3\nSpring Cloud Commons 4.0.0 - 4.2.6\nSpring Cloud Commons 3.1.10 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:57:42.527Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59284"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Spring Cloud Commons no allow list for writable env actuator endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59284",
"datePublished": "2026-08-27T17:57:42.527Z",
"dateReserved": "2026-07-04T18:13:26.297Z",
"dateUpdated": "2026-08-28T18:32:18.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59355 (GCVE-0-2026-59355)
Vulnerability from nvd – Published: 2026-08-27 06:35 – Updated: 2026-08-27 13:37
VLAI
EPSS
VEX
Title
Spring Authorization Server: Open Redirect via request_uri parameter
Summary
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:37 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://spring.io/security/cve-2026-59355 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| VMware | Spring Authorization Server |
Affected:
1.5.0 , ≤ 1.5.7
(semver)
Unaffected: 1.5.8 (OSS) Unaffected: 1.5.7.1 (enterprise support only) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59355",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:37:03.989783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:37:30.618Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2/org/springframework/security/spring-security-oauth2-authorization-server/",
"defaultStatus": "unaffected",
"packageName": "org.springframework.security:spring-security-oauth2-authorization-server",
"product": "Spring Authorization Server",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "1.5.7",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.5.8",
"versionType": "OSS"
},
{
"status": "unaffected",
"version": "1.5.7.1",
"versionType": "enterprise support only"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jon Kjennbakken (Vipps MobilePay)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.\u003c/p\u003e"
}
],
"value": "In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T06:35:09.607Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"name": "spring.io",
"tags": [
"vendor-advisory"
],
"url": "https://spring.io/security/cve-2026-59355"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Spring Authorization Server 1.5.8 (OSS) or 1.5.7.1 (Enterprise Support customers). No additional mitigation is required after upgrading.\u003c/p\u003e"
}
],
"value": "Upgrade to Spring Authorization Server 1.5.8 (OSS) or 1.5.7.1 (Enterprise Support customers). No additional mitigation is required after upgrading."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-09T00:00:00.000Z",
"value": "Public disclosure and fix released (Spring Authorization Server 1.5.8 / 1.5.7.1)."
}
],
"title": "Spring Authorization Server: Open Redirect via request_uri parameter"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59355",
"datePublished": "2026-08-27T06:35:09.607Z",
"dateReserved": "2026-07-04T18:14:46.172Z",
"dateUpdated": "2026-08-27T13:37:30.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47881 (GCVE-0-2026-47881)
Vulnerability from nvd – Published: 2026-08-27 05:20 – Updated: 2026-08-27 14:21
VLAI
EPSS
VEX
Title
Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
Summary
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory.
Spring Batch 6.0.0 - 6.0.4
Spring Batch 5.2.0 - 5.2.6
Spring Batch 4.3.0 - 4.3.13
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:19 UTC
CWE
- CWE-400 Uncontrolled Resource Consumption
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring Batch |
Affected:
6.0.0 , ≤ 6.0.4
(custom)
Affected: 5.2.0 , ≤ 5.2.6 (custom) Affected: 4.3.0 , ≤ 4.3.13 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47881",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:19:10.524331Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:21:14.631Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring Batch",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "6.0.4",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.2.6",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.3.13",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSpring Batch\u0027s FlatFileItemReader supports files where a single logical record spans multiple physical lines \u2014 for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory.\u003c/p\u003e\u003cp\u003eSpring Batch 6.0.0 - 6.0.4\u003cbr/\u003eSpring Batch 5.2.0 - 5.2.6\u003cbr/\u003eSpring Batch 4.3.0 - 4.3.13\u003c/p\u003e"
}
],
"value": "Spring Batch\u0027s FlatFileItemReader supports files where a single logical record spans multiple physical lines \u2014 for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory.\nSpring Batch 6.0.0 - 6.0.4\nSpring Batch 5.2.0 - 5.2.6\nSpring Batch 4.3.0 - 4.3.13"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Spring Batch\u0027s FlatFileItemReader supports files where a single logical record spans multiple physical lines \u2014 for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:21:31.231Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-47881"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47881",
"datePublished": "2026-08-27T05:20:26.323Z",
"dateReserved": "2026-05-20T10:00:58.694Z",
"dateUpdated": "2026-08-27T14:21:14.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47878 (GCVE-0-2026-47878)
Vulnerability from nvd – Published: 2026-08-27 05:20 – Updated: 2026-08-27 14:32
VLAI
EPSS
VEX
Title
Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
Summary
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist.
Spring Batch 6.0.0 - 6.0.4
Spring Batch 5.2.6 and earlier
Severity
5.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:30 UTC
CWE
- CWE-502 Deserialization of Untrusted Data
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring Batch |
Affected:
6.0.0 , ≤ 6.0.4
(custom)
Affected: 0 , ≤ 5.2.6 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47878",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:30:21.504502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:32:28.405Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring Batch",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "6.0.4",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.2.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDefaultExecutionContextSerializer, used by default in Spring Batch\u0027s JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist.\u003c/p\u003e\u003cp\u003eSpring Batch 6.0.0 - 6.0.4\u003cbr/\u003eSpring Batch 5.2.6 and earlier\u003c/p\u003e"
}
],
"value": "DefaultExecutionContextSerializer, used by default in Spring Batch\u0027s JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist.\nSpring Batch 6.0.0 - 6.0.4\nSpring Batch 5.2.6 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "DefaultExecutionContextSerializer, used by default in Spring Batch\u0027s JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:21:29.918Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-47878"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47878",
"datePublished": "2026-08-27T05:20:23.462Z",
"dateReserved": "2026-05-20T10:00:58.694Z",
"dateUpdated": "2026-08-27T14:32:28.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47875 (GCVE-0-2026-47875)
Vulnerability from nvd – Published: 2026-08-27 05:20 – Updated: 2026-08-28 16:52
VLAI
EPSS
VEX
Title
JobParameterDeserializer bypasses the trusted-type allowlist
Summary
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.
Spring Batch 6.0.0 - 6.0.4
Spring Batch 5.2.0 - 5.2.6
Severity
5.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 03:55 UTC
CWE
- CWE-502 Deserialization of Untrusted Data
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring Batch |
Affected:
6.0.0 , ≤ 6.0.4
(custom)
Affected: 5.2.0 , ≤ 5.2.6 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T03:55:33.837800Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:52:00.046Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring Batch",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "6.0.4",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.2.6",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eApplications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.\u003c/p\u003e\u003cp\u003eSpring Batch 6.0.0 - 6.0.4\u003cbr/\u003eSpring Batch 5.2.0 - 5.2.6\u003c/p\u003e"
}
],
"value": "Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.\nSpring Batch 6.0.0 - 6.0.4\nSpring Batch 5.2.0 - 5.2.6"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:21:29.079Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-47875"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "JobParameterDeserializer bypasses the trusted-type allowlist"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47875",
"datePublished": "2026-08-27T05:20:21.578Z",
"dateReserved": "2026-05-20T10:00:58.694Z",
"dateUpdated": "2026-08-28T16:52:00.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47863 (GCVE-0-2026-47863)
Vulnerability from nvd – Published: 2026-08-26 23:28 – Updated: 2026-08-27 14:45
VLAI
EPSS
VEX
Title
Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush
Summary
In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.
Reactor Core 3.8.0 - 3.8.6
Reactor Core 3.7.19 and earlier
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:45 UTC
CWE
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Reactor Core |
Affected:
3.8.0 , ≤ 3.8.6
(custom)
Affected: 0 , ≤ 3.7.19 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47863",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:45:18.748037Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:45:41.473Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Reactor Core",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "3.8.6",
"status": "affected",
"version": "3.8.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.7.19",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\u003c/p\u003e\u003cp\u003eReactor Core 3.8.0 - 3.8.6\u003cbr/\u003eReactor Core 3.7.19 and earlier\u003c/p\u003e"
}
],
"value": "In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.7.19 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T23:28:48.599Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-47863"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47863",
"datePublished": "2026-08-26T23:28:48.599Z",
"dateReserved": "2026-05-20T10:00:55.157Z",
"dateUpdated": "2026-08-27T14:45:41.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47857 (GCVE-0-2026-47857)
Vulnerability from nvd – Published: 2026-08-26 23:28 – Updated: 2026-08-27 15:07
VLAI
EPSS
VEX
Title
Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around
Summary
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.
Reactor Core 3.8.0 - 3.8.6
Reactor Core 3.5.0 - 3.7.19
Reactor Core 3.4.41 and earlier
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 15:07 UTC
CWE
- CWE-190 Integer Overflow or Wraparound
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Reactor Core |
Affected:
3.8.0 , ≤ 3.8.6
(custom)
Affected: 3.5.0 , ≤ 3.7.19 (custom) Affected: 0 , ≤ 3.4.41 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47857",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T15:07:04.132397Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:07:38.775Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Reactor Core",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "3.8.6",
"status": "affected",
"version": "3.8.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.7.19",
"status": "affected",
"version": "3.5.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.4.41",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\u003c/p\u003e\u003cp\u003eReactor Core 3.8.0 - 3.8.6\u003cbr/\u003eReactor Core 3.5.0 - 3.7.19\u003cbr/\u003eReactor Core 3.4.41 and earlier\u003c/p\u003e"
}
],
"value": "In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.5.0 - 3.7.19\nReactor Core 3.4.41 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T23:28:44.743Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-47857"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47857",
"datePublished": "2026-08-26T23:28:44.743Z",
"dateReserved": "2026-05-20T10:00:55.156Z",
"dateUpdated": "2026-08-27T15:07:38.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47845 (GCVE-0-2026-47845)
Vulnerability from nvd – Published: 2026-08-26 23:28 – Updated: 2026-08-27 14:02
VLAI
EPSS
VEX
Title
Reactor Netty HTTP Server may incorrectly evaluate proxy addresses
Summary
In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol.
Reactor Netty 1.3.0 - 1.3.6
Reactor Netty 1.1.0 - 1.2.18
Reactor Netty 1.0.52 and earlier
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:02 UTC
CWE
- CWE-290 Authentication Bypass by Spoofing
- CWE-290 - Authentication Bypass by Spoofing
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Reactor Netty |
Affected:
1.3.0 , ≤ 1.3.6
(custom)
Affected: 1.1.0 , ≤ 1.2.18 (custom) Affected: 0 , ≤ 1.0.52 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47845",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:02:16.353921Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:02:35.899Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Reactor Netty",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "1.3.6",
"status": "affected",
"version": "1.3.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.2.18",
"status": "affected",
"version": "1.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.0.52",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol.\u003c/p\u003e\u003cp\u003eReactor Netty 1.3.0 - 1.3.6\u003cbr/\u003eReactor Netty 1.1.0 - 1.2.18\u003cbr/\u003eReactor Netty 1.0.52 and earlier\u003c/p\u003e"
}
],
"value": "In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol.\nReactor Netty 1.3.0 - 1.3.6\nReactor Netty 1.1.0 - 1.2.18\nReactor Netty 1.0.52 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T23:28:39.360Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-47845"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reactor Netty HTTP Server may incorrectly evaluate proxy addresses"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47845",
"datePublished": "2026-08-26T23:28:39.360Z",
"dateReserved": "2026-05-20T10:00:53.146Z",
"dateUpdated": "2026-08-27T14:02:35.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67421 (GCVE-0-2026-67421)
Vulnerability from cvelistv5 – Published: 2026-09-25 16:39 – Updated: 2026-09-25 19:58
VLAI
EPSS
VEX
Title
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling
Summary
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim's Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 19:57 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 3.13.0, < 3.13.19
Affected: >= 4.0.0, < 4.0.24 Affected: >= 4.1.0, < 4.1.15 Affected: >= 4.2.0, < 4.2.10 Affected: >= 4.3.0, < 4.3.5 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67421",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T19:57:04.069632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T19:58:22.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6256-27fm-4rgr"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.13.0, \u003c 3.13.19"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.0.24"
},
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.1.15"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.10"
},
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an attacker with queue configure permission, a management administrator who can see but cannot read that queue, and the administrator clicking Get Message(s). A queue name containing a base element can then retarget the automatic relative refresh because the Content Security Policy omits base-uri and connect-src, and an attacker endpoint that permits the management origin through CORS can receive the victim\u0027s Authorization header. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:39:02.323Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6256-27fm-4rgr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6256-27fm-4rgr"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/ff595eaaa6d4f580f72fa04801ffd35f48c46027",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/ff595eaaa6d4f580f72fa04801ffd35f48c46027"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5"
}
],
"source": {
"advisory": "GHSA-6256-27fm-4rgr",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-67421",
"datePublished": "2026-09-25T16:39:02.323Z",
"dateReserved": "2026-07-29T15:02:20.412Z",
"dateUpdated": "2026-09-25T19:58:22.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67408 (GCVE-0-2026-67408)
Vulnerability from cvelistv5 – Published: 2026-09-25 16:35 – Updated: 2026-09-25 19:09
VLAI
EPSS
VEX
Title
RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service
Summary
RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 19:09 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 4.3.0, < 4.3.3
Affected: >= 4.2.0, < 4.2.9 Affected: >= 4.1.0, < 4.1.11 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67408",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T19:09:46.402384Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T19:09:53.750Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.3"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.9"
},
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.1.11"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:35:22.829Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/0f3defd176e027f54f447beee168d906d4f109b6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/0f3defd176e027f54f447beee168d906d4f109b6"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/eb11bc44005fd6d327a78bf171bc598207778c9b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/eb11bc44005fd6d327a78bf171bc598207778c9b"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3"
}
],
"source": {
"advisory": "GHSA-2hm4-4438-49q8",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-67408",
"datePublished": "2026-09-25T16:35:22.829Z",
"dateReserved": "2026-07-29T15:02:20.411Z",
"dateUpdated": "2026-09-25T19:09:53.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67410 (GCVE-0-2026-67410)
Vulnerability from cvelistv5 – Published: 2026-09-25 16:32 – Updated: 2026-09-25 17:46
VLAI
EPSS
VEX
Title
RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint
Summary
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecret configuration value is included in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. Any user who can reach the management UI port can retrieve the OAuth2 client secret without Files: deps/rabbitmqmanagement/src/rabbitmgmtwmauth.erl, line 186 deps/rabbitmqmanagement/src/rabbitmgmtoauthbootstrap.erl, lines 35-50 deps/rabbitmqmanagement/src/rabbitmgmtdispatcher.erl, lines 45-49 (route registration) Code Path: 1. The route /js/oidc-oauth/bootstrap.js is registered as a plain Cowboy handler (rabbitmgmtdispatcher.erl:46): Credential exposure for the affected configuration: OAuth2 client secret is accessible without any authentication Token theft: Attacker can complete the authorization code flow using stolen authorization codes Client impersonation: Attacker can make requests. Any RabbitMQ deployment with: This issue is fixed in versions 4.3.3 and 4.2.9.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 17:45 UTC
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 4.3.0, < 4.3.3
Affected: >= 4.2.0, < 4.2.9 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67410",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T17:45:46.514401Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T17:46:42.745Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.3"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.9"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200). when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecret configuration value is included in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js. Any user who can reach the management UI port can retrieve the OAuth2 client secret without Files: deps/rabbitmqmanagement/src/rabbitmgmtwmauth.erl, line 186 deps/rabbitmqmanagement/src/rabbitmgmtoauthbootstrap.erl, lines 35-50 deps/rabbitmqmanagement/src/rabbitmgmtdispatcher.erl, lines 45-49 (route registration) Code Path: 1. The route /js/oidc-oauth/bootstrap.js is registered as a plain Cowboy handler (rabbitmgmtdispatcher.erl:46): Credential exposure for the affected configuration: OAuth2 client secret is accessible without any authentication Token theft: Attacker can complete the authorization code flow using stolen authorization codes Client impersonation: Attacker can make requests. Any RabbitMQ deployment with: This issue is fixed in versions 4.3.3 and 4.2.9."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:32:51.225Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f9f2-q3jf-wfj3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f9f2-q3jf-wfj3"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/60a85d3605ebf94fd234497242812547d441d457",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/60a85d3605ebf94fd234497242812547d441d457"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/869f800998334bb363f2ad046f58de9caedc409e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/869f800998334bb363f2ad046f58de9caedc409e"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3"
}
],
"source": {
"advisory": "GHSA-f9f2-q3jf-wfj3",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-67410",
"datePublished": "2026-09-25T16:32:51.225Z",
"dateReserved": "2026-07-29T15:02:20.412Z",
"dateUpdated": "2026-09-25T17:46:42.745Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67411 (GCVE-0-2026-67411)
Vulnerability from cvelistv5 – Published: 2026-09-25 16:26 – Updated: 2026-09-25 16:55
VLAI
EPSS
VEX
Title
RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass
Summary
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopback_users, causing the frontend-to-broker address to be treated as loopback. An attacker who can reach the trusted frontend and has valid credentials for a loopback-restricted account can therefore bypass the source-address restriction; the issue does not bypass password authentication. This issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 16:55 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 4.3.0, < 4.3.3
Affected: >= 4.2.0, < 4.2.9 Affected: >= 4.1.0, < 4.1.14 Affected: >= 4.0.0, < 4.0.23 Affected: >= 3.13.0, < 3.13.18 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67411",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T16:55:11.064286Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:55:42.722Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-4r6f-9cpw-f6g6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.3"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.9"
},
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.1.14"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.0.23"
},
{
"status": "affected",
"version": "\u003e= 3.13.0, \u003c 3.13.18"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopback_users, causing the frontend-to-broker address to be treated as loopback. An attacker who can reach the trusted frontend and has valid credentials for a loopback-restricted account can therefore bypass the source-address restriction; the issue does not bypass password authentication. This issue is fixed in versions 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:26:33.880Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-4r6f-9cpw-f6g6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-4r6f-9cpw-f6g6"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/a7528314840c4f8dc9904684f9f97ffa7aac6349",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/a7528314840c4f8dc9904684f9f97ffa7aac6349"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/edbead0eabbd65925d0dc914a22d6a29e155e646",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/edbead0eabbd65925d0dc914a22d6a29e155e646"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3"
}
],
"source": {
"advisory": "GHSA-4r6f-9cpw-f6g6",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-67411",
"datePublished": "2026-09-25T16:26:33.880Z",
"dateReserved": "2026-07-29T15:02:20.412Z",
"dateUpdated": "2026-09-25T16:55:42.722Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67412 (GCVE-0-2026-67412)
Vulnerability from cvelistv5 – Published: 2026-09-25 16:20 – Updated: 2026-09-25 16:45
VLAI
EPSS
VEX
Title
RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access
Summary
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost reads and drains messages out of another vhost it has no permission on. With the default ack-mode the source messages are consumed (deleted), not copied. Why that should not 1. Federation validates the upstream URI without any vhost-access Cross-vhost message read/drain from a per-vhost policymaker, breaking vhost tenancy This issue is fixed in versions 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 16:44 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 4.3.0, < 4.3.3
Affected: >= 4.2.0, < 4.2.9 Affected: >= 4.1.0, < 4.1.14 Affected: >= 4.0.0, < 4.0.24 Affected: >= 3.13.0, < 3.13.18 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67412",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T16:44:37.491195Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:45:00.348Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-42pc-678q-v8qj"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.3"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.9"
},
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.1.14"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.0.24"
},
{
"status": "affected",
"version": "\u003e= 3.13.0, \u003c 3.13.18"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost reads and drains messages out of another vhost it has no permission on. With the default ack-mode the source messages are consumed (deleted), not copied. Why that should not 1. Federation validates the upstream URI without any vhost-access Cross-vhost message read/drain from a per-vhost policymaker, breaking vhost tenancy This issue is fixed in versions 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:20:13.605Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-42pc-678q-v8qj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-42pc-678q-v8qj"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3"
}
],
"source": {
"advisory": "GHSA-42pc-678q-v8qj",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-67412",
"datePublished": "2026-09-25T16:20:13.605Z",
"dateReserved": "2026-07-29T15:02:20.412Z",
"dateUpdated": "2026-09-25T16:45:00.348Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-67409 (GCVE-0-2026-67409)
Vulnerability from cvelistv5 – Published: 2026-09-25 16:18 – Updated: 2026-09-25 17:49
VLAI
EPSS
VEX
Title
RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS
Summary
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252). the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code when downloading signing keys from the OAuth2 provider's JWKS endpoint. Non-200 responses (including 4xx and 5xx errors) are processed identically to successful responses. When the JWKS endpoint returns an error response with a valid-JSON body that lacks a keys field, all previously cached signing keys are destroyed, causing a persistent authentication denial of Files: deps/rabbitmqauthbackendoauth2/src/uaajwt.erl, lines 50-63 deps/rabbitmqauthbackendoauth2/src/uaajwks.erl, lines 5-7 deps/rabbitmqauthbackendoauth2/src/rabbitoauth2provider.erl, lines 98-107 Bug 1: HTTP status code ignored (uaajwt.erl:50-63): The Erlang httpc module returns {ok, {{HttpVersion, StatusCode, ReasonPhrase}, Headers, Body}}. The pattern {ok, {, , JwksBody}} matches ANY successful HTTP transaction Persistent authentication DoS: Once keys are destroyed, ALL OAuth2/JWT authentication fails for all users until a new successful JWKS refresh occurs Amplification: A single attacker can deny access to all legitimate OAuth2 users across the entire RabbitMQ. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 17:49 UTC
CWE
- CWE-252 - Unchecked Return Value
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 4.3.0, < 4.3.3
Affected: >= 4.2.0, < 4.2.9 Affected: >= 4.1.0, < 4.1.14 Affected: >= 4.0.0, < 4.0.23 Affected: >= 3.13.0, < 3.13.18 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-67409",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T17:49:17.770463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T17:49:48.064Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qw3h-qqm9-jrw8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.3.0, \u003c 4.3.3"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.9"
},
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.1.14"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.0.23"
},
{
"status": "affected",
"version": "\u003e= 3.13.0, \u003c 3.13.18"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252). the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response status code when downloading signing keys from the OAuth2 provider\u0027s JWKS endpoint. Non-200 responses (including 4xx and 5xx errors) are processed identically to successful responses. When the JWKS endpoint returns an error response with a valid-JSON body that lacks a keys field, all previously cached signing keys are destroyed, causing a persistent authentication denial of Files: deps/rabbitmqauthbackendoauth2/src/uaajwt.erl, lines 50-63 deps/rabbitmqauthbackendoauth2/src/uaajwks.erl, lines 5-7 deps/rabbitmqauthbackendoauth2/src/rabbitoauth2provider.erl, lines 98-107 Bug 1: HTTP status code ignored (uaajwt.erl:50-63): The Erlang httpc module returns {ok, {{HttpVersion, StatusCode, ReasonPhrase}, Headers, Body}}. The pattern {ok, {, , JwksBody}} matches ANY successful HTTP transaction Persistent authentication DoS: Once keys are destroyed, ALL OAuth2/JWT authentication fails for all users until a new successful JWKS refresh occurs Amplification: A single attacker can deny access to all legitimate OAuth2 users across the entire RabbitMQ. This issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252: Unchecked Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:18:25.611Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qw3h-qqm9-jrw8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qw3h-qqm9-jrw8"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3"
}
],
"source": {
"advisory": "GHSA-qw3h-qqm9-jrw8",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-67409",
"datePublished": "2026-09-25T16:18:25.611Z",
"dateReserved": "2026-07-29T15:02:20.412Z",
"dateUpdated": "2026-09-25T17:49:48.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66073 (GCVE-0-2026-66073)
Vulnerability from cvelistv5 – Published: 2026-09-25 16:06 – Updated: 2026-09-25 16:43
VLAI
EPSS
VEX
Title
RabbitMQ: Atom table exhaustion via management API node field
Summary
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name (and the exchanges and bindings endpoints) accepts a node JSON field. The value goes through rabbitnodes:make → listtoatom with no cluster membership check first. Each unique value permanently leaks one atom. A March 2026 refactoring (ea61ce2563) introduced safe helpers in rabbitmgmtnodes.erl (parsenodename, safeatom, and requirenodename, using binarytoexistingatom) and fixed several callers (QQ replica ops, wmauthattempts, wmnodememoryets, getsortreverse, and rabbitfederationmgmt), but getnode/1 in rabbitmgmtutil.erl:880-885, the primary vector used by directrequest/6, was not Roughly 900K requests crash the VM via systemlimit, and all tenants lose Any user with the management tag and one vhost, the lowest privilege This issue is fixed in versions 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 16:43 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/rabbitmq/rabbitmq-server/secur… | x_refsource_CONFIRM |
| https://github.com/rabbitmq/rabbitmq-server/commi… | x_refsource_MISC |
| https://github.com/rabbitmq/rabbitmq-server/relea… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rabbitmq | rabbitmq-server |
Affected:
>= 3.13.0, < 3.13.15
Affected: >= 4.0.0, < 4.0.20 Affected: >= 4.1.0, < 4.1.11 Affected: >= 4.2.0, < 4.2.6 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66073",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T16:43:02.733440Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:43:12.504Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "rabbitmq-server",
"vendor": "rabbitmq",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.13.0, \u003c 3.13.15"
},
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.0.20"
},
{
"status": "affected",
"version": "\u003e= 4.1.0, \u003c 4.1.11"
},
{
"status": "affected",
"version": "\u003e= 4.2.0, \u003c 4.2.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name (and the exchanges and bindings endpoints) accepts a node JSON field. The value goes through rabbitnodes:make \u2192 listtoatom with no cluster membership check first. Each unique value permanently leaks one atom. A March 2026 refactoring (ea61ce2563) introduced safe helpers in rabbitmgmtnodes.erl (parsenodename, safeatom, and requirenodename, using binarytoexistingatom) and fixed several callers (QQ replica ops, wmauthattempts, wmnodememoryets, getsortreverse, and rabbitfederationmgmt), but getnode/1 in rabbitmgmtutil.erl:880-885, the primary vector used by directrequest/6, was not Roughly 900K requests crash the VM via systemlimit, and all tenants lose Any user with the management tag and one vhost, the lowest privilege This issue is fixed in versions 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T16:06:20.501Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6v53-r759-jrvx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6v53-r759-jrvx"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/commit/7f64311471840e68f8cae09e4d4fdc4c8aca9229",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/7f64311471840e68f8cae09e4d4fdc4c8aca9229"
},
{
"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
}
],
"source": {
"advisory": "GHSA-6v53-r759-jrvx",
"discovery": "UNKNOWN"
},
"title": "RabbitMQ: Atom table exhaustion via management API node field"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66073",
"datePublished": "2026-09-25T16:06:20.501Z",
"dateReserved": "2026-07-23T23:25:28.897Z",
"dateUpdated": "2026-09-25T16:43:12.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59316 (GCVE-0-2026-59316)
Vulnerability from cvelistv5 – Published: 2026-08-27 18:04 – Updated: 2026-08-28 22:47
VLAI
EPSS
VEX
Title
Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
Summary
Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user.
Spring Authorization Server 1.5.0 - 1.5.8
Spring Authorization Server 1.4.0 - 1.4.11
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 22:43 UTC
CWE
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring Authorization Server |
Affected:
1.5.0 , ≤ 1.5.8
(custom)
Affected: 1.4.0 , ≤ 1.4.11 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59316",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T22:43:12.525554Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T22:47:16.884Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring Authorization Server",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "1.5.8",
"status": "affected",
"version": "1.5.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.4.11",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSpring Authorization Server\u0027s default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user.\u003c/p\u003e\u003cp\u003eSpring Authorization Server 1.5.0 - 1.5.8\u003cbr/\u003eSpring Authorization Server 1.4.0 - 1.4.11\u003c/p\u003e"
}
],
"value": "Spring Authorization Server\u0027s default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user.\nSpring Authorization Server 1.5.0 - 1.5.8\nSpring Authorization Server 1.4.0 - 1.4.11"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Spring Authorization Server\u0027s default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T18:04:44.963Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59316"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59316",
"datePublished": "2026-08-27T18:04:44.963Z",
"dateReserved": "2026-07-04T18:13:57.026Z",
"dateUpdated": "2026-08-28T22:47:16.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59284 (GCVE-0-2026-59284)
Vulnerability from cvelistv5 – Published: 2026-08-27 17:57 – Updated: 2026-08-28 18:32
VLAI
EPSS
VEX
Title
Spring Cloud Commons no allow list for writable env actuator endpoint
Summary
There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.
Spring Cloud Commons 5.0.0 - 5.0.2
Spring Cloud Commons 4.3.0 - 4.3.3
Spring Cloud Commons 4.0.0 - 4.2.6
Spring Cloud Commons 3.1.10 and earlier
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 18:28 UTC
CWE
- CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
- CWE-915 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring Cloud Commons |
Affected:
5.0.0 , ≤ 5.0.2
(custom)
Affected: 4.3.0 , ≤ 4.3.3 (custom) Affected: 4.0.0 , ≤ 4.2.6 (custom) Affected: 0 , ≤ 3.1.10 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59284",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T18:28:29.044888Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T18:32:18.345Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring Cloud Commons",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "5.0.2",
"status": "affected",
"version": "5.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.3.3",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.2.6",
"status": "affected",
"version": "4.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.1.10",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.\u003c/p\u003e\u003cp\u003eSpring Cloud Commons 5.0.0 - 5.0.2\u003cbr/\u003eSpring Cloud Commons 4.3.0 - 4.3.3\u003cbr/\u003eSpring Cloud Commons 4.0.0 - 4.2.6\u003cbr/\u003eSpring Cloud Commons 3.1.10 and earlier\u003c/p\u003e"
}
],
"value": "There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled.\nSpring Cloud Commons 5.0.0 - 5.0.2\nSpring Cloud Commons 4.3.0 - 4.3.3\nSpring Cloud Commons 4.0.0 - 4.2.6\nSpring Cloud Commons 3.1.10 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T17:57:42.527Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-59284"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Spring Cloud Commons no allow list for writable env actuator endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59284",
"datePublished": "2026-08-27T17:57:42.527Z",
"dateReserved": "2026-07-04T18:13:26.297Z",
"dateUpdated": "2026-08-28T18:32:18.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-59355 (GCVE-0-2026-59355)
Vulnerability from cvelistv5 – Published: 2026-08-27 06:35 – Updated: 2026-08-27 13:37
VLAI
EPSS
VEX
Title
Spring Authorization Server: Open Redirect via request_uri parameter
Summary
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 13:37 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://spring.io/security/cve-2026-59355 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| VMware | Spring Authorization Server |
Affected:
1.5.0 , ≤ 1.5.7
(semver)
Unaffected: 1.5.8 (OSS) Unaffected: 1.5.7.1 (enterprise support only) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-59355",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T13:37:03.989783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T13:37:30.618Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2/org/springframework/security/spring-security-oauth2-authorization-server/",
"defaultStatus": "unaffected",
"packageName": "org.springframework.security:spring-security-oauth2-authorization-server",
"product": "Spring Authorization Server",
"vendor": "VMware",
"versions": [
{
"lessThanOrEqual": "1.5.7",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.5.8",
"versionType": "OSS"
},
{
"status": "unaffected",
"version": "1.5.7.1",
"versionType": "enterprise support only"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Jon Kjennbakken (Vipps MobilePay)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.\u003c/p\u003e"
}
],
"value": "In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T06:35:09.607Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"name": "spring.io",
"tags": [
"vendor-advisory"
],
"url": "https://spring.io/security/cve-2026-59355"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Spring Authorization Server 1.5.8 (OSS) or 1.5.7.1 (Enterprise Support customers). No additional mitigation is required after upgrading.\u003c/p\u003e"
}
],
"value": "Upgrade to Spring Authorization Server 1.5.8 (OSS) or 1.5.7.1 (Enterprise Support customers). No additional mitigation is required after upgrading."
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-09T00:00:00.000Z",
"value": "Public disclosure and fix released (Spring Authorization Server 1.5.8 / 1.5.7.1)."
}
],
"title": "Spring Authorization Server: Open Redirect via request_uri parameter"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-59355",
"datePublished": "2026-08-27T06:35:09.607Z",
"dateReserved": "2026-07-04T18:14:46.172Z",
"dateUpdated": "2026-08-27T13:37:30.618Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47881 (GCVE-0-2026-47881)
Vulnerability from cvelistv5 – Published: 2026-08-27 05:20 – Updated: 2026-08-27 14:21
VLAI
EPSS
VEX
Title
Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
Summary
Spring Batch's FlatFileItemReader supports files where a single logical record spans multiple physical lines — for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory.
Spring Batch 6.0.0 - 6.0.4
Spring Batch 5.2.0 - 5.2.6
Spring Batch 4.3.0 - 4.3.13
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:19 UTC
CWE
- CWE-400 Uncontrolled Resource Consumption
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring Batch |
Affected:
6.0.0 , ≤ 6.0.4
(custom)
Affected: 5.2.0 , ≤ 5.2.6 (custom) Affected: 4.3.0 , ≤ 4.3.13 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47881",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:19:10.524331Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:21:14.631Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring Batch",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "6.0.4",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.2.6",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.3.13",
"status": "affected",
"version": "4.3.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSpring Batch\u0027s FlatFileItemReader supports files where a single logical record spans multiple physical lines \u2014 for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory.\u003c/p\u003e\u003cp\u003eSpring Batch 6.0.0 - 6.0.4\u003cbr/\u003eSpring Batch 5.2.0 - 5.2.6\u003cbr/\u003eSpring Batch 4.3.0 - 4.3.13\u003c/p\u003e"
}
],
"value": "Spring Batch\u0027s FlatFileItemReader supports files where a single logical record spans multiple physical lines \u2014 for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory.\nSpring Batch 6.0.0 - 6.0.4\nSpring Batch 5.2.0 - 5.2.6\nSpring Batch 4.3.0 - 4.3.13"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Spring Batch\u0027s FlatFileItemReader supports files where a single logical record spans multiple physical lines \u2014 for example, a CSV field that contains embedded newlines wrapped in quotes. A specially crafted input file could exploit the way the reader assembles those multi-line records to consume excessive CPU time and memory, causing the batch job to stall or run out of memory."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:21:31.231Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-47881"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47881",
"datePublished": "2026-08-27T05:20:26.323Z",
"dateReserved": "2026-05-20T10:00:58.694Z",
"dateUpdated": "2026-08-27T14:21:14.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47878 (GCVE-0-2026-47878)
Vulnerability from cvelistv5 – Published: 2026-08-27 05:20 – Updated: 2026-08-27 14:32
VLAI
EPSS
VEX
Title
Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
Summary
DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist.
Spring Batch 6.0.0 - 6.0.4
Spring Batch 5.2.6 and earlier
Severity
5.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:30 UTC
CWE
- CWE-502 Deserialization of Untrusted Data
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring Batch |
Affected:
6.0.0 , ≤ 6.0.4
(custom)
Affected: 0 , ≤ 5.2.6 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47878",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:30:21.504502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:32:28.405Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring Batch",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "6.0.4",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.2.6",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDefaultExecutionContextSerializer, used by default in Spring Batch\u0027s JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist.\u003c/p\u003e\u003cp\u003eSpring Batch 6.0.0 - 6.0.4\u003cbr/\u003eSpring Batch 5.2.6 and earlier\u003c/p\u003e"
}
],
"value": "DefaultExecutionContextSerializer, used by default in Spring Batch\u0027s JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist.\nSpring Batch 6.0.0 - 6.0.4\nSpring Batch 5.2.6 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "DefaultExecutionContextSerializer, used by default in Spring Batch\u0027s JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject() without an ObjectInputFilter that restricts types to a trusted class allowlist."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:21:29.918Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-47878"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47878",
"datePublished": "2026-08-27T05:20:23.462Z",
"dateReserved": "2026-05-20T10:00:58.694Z",
"dateUpdated": "2026-08-27T14:32:28.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47875 (GCVE-0-2026-47875)
Vulnerability from cvelistv5 – Published: 2026-08-27 05:20 – Updated: 2026-08-28 16:52
VLAI
EPSS
VEX
Title
JobParameterDeserializer bypasses the trusted-type allowlist
Summary
Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.
Spring Batch 6.0.0 - 6.0.4
Spring Batch 5.2.0 - 5.2.6
Severity
5.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 03:55 UTC
CWE
- CWE-502 Deserialization of Untrusted Data
- CWE-502 - Deserialization of Untrusted Data
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Spring Batch |
Affected:
6.0.0 , ≤ 6.0.4
(custom)
Affected: 5.2.0 , ≤ 5.2.6 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T03:55:33.837800Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:52:00.046Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Spring Batch",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "6.0.4",
"status": "affected",
"version": "6.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.2.6",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eApplications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.\u003c/p\u003e\u003cp\u003eSpring Batch 6.0.0 - 6.0.4\u003cbr/\u003eSpring Batch 5.2.0 - 5.2.6\u003c/p\u003e"
}
],
"value": "Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets.\nSpring Batch 6.0.0 - 6.0.4\nSpring Batch 5.2.0 - 5.2.6"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Applications that deserialize execution contexts with Jackson2ExecutionContextStringSerializer are vulnerable to a deserialization attack if they use an untrusted data source for the job repository. The JobParameterDeserializer does not properly enforce the trusted-types allowlist, allowing an attacker to craft malicious input that can lead to arbitrary code execution, including known Jackson RCE gadgets."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-502 Deserialization of Untrusted Data",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:21:29.079Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-47875"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "JobParameterDeserializer bypasses the trusted-type allowlist"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47875",
"datePublished": "2026-08-27T05:20:21.578Z",
"dateReserved": "2026-05-20T10:00:58.694Z",
"dateUpdated": "2026-08-28T16:52:00.046Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47863 (GCVE-0-2026-47863)
Vulnerability from cvelistv5 – Published: 2026-08-26 23:28 – Updated: 2026-08-27 14:45
VLAI
EPSS
VEX
Title
Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush
Summary
In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.
Reactor Core 3.8.0 - 3.8.6
Reactor Core 3.7.19 and earlier
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 14:45 UTC
CWE
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Spring | Reactor Core |
Affected:
3.8.0 , ≤ 3.8.6
(custom)
Affected: 0 , ≤ 3.7.19 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47863",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T14:45:18.748037Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-835",
"description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T14:45:41.473Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Reactor Core",
"vendor": "Spring",
"versions": [
{
"lessThanOrEqual": "3.8.6",
"status": "affected",
"version": "3.8.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "3.7.19",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\u003c/p\u003e\u003cp\u003eReactor Core 3.8.0 - 3.8.6\u003cbr/\u003eReactor Core 3.7.19 and earlier\u003c/p\u003e"
}
],
"value": "In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition.\nReactor Core 3.8.0 - 3.8.6\nReactor Core 3.7.19 and earlier"
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition."
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T23:28:48.599Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://spring.io/security/cve-2026-47863"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush"
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-47863",
"datePublished": "2026-08-26T23:28:48.599Z",
"dateReserved": "2026-05-20T10:00:55.157Z",
"dateUpdated": "2026-08-27T14:45:41.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}