USN-8933-1 (UBUNTU-CVE-2026-66070)
Vulnerability from osv_ubuntu – Published: 2026-10-15 17:27 – Updated: 2026-10-15 17:27 – Source website
VLAI
Summary
rabbitmq-server vulnerabilities
Details
It was discovered that RabbitMQ Server incorrectly handled CORS wildcard origin configuration. An attacker could possibly use this issue to cause a cross-site request forgery attack. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-66070)
It was discovered that RabbitMQ Server incorrectly handled TLS peer-certificate DNs in the management UI. An attacker could possibly use this issue to cause a cross-site scripting attack. (CVE-2026-66077)
It was discovered that RabbitMQ Server incorrectly handled AMQP 1.0 arrays with zero-width element constructors. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-66079)
It was discovered that RabbitMQ Server trust-store plugin incorrectly validated client certificates. An attacker could possibly use this issue to bypass TLS client authentication. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67231)
It was discovered that RabbitMQ Server incorrectly handled WebSocket frame sizes. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67232)
It was discovered that RabbitMQ Server incorrectly handled content-header body sizes. An attacker could possibly use this issue to cause a denial of service. (CVE-2026-67235)
It was discovered that RabbitMQ Server incorrectly stored credentials in an insecure cookie. An attacker could possibly use this issue to expose sensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67236)
It was discovered that RabbitMQ Server incorrectly handled OAuth bearer tokens in bootstrap JavaScript. An attacker could possibly use this issue to cause a cross-site scripting attack. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-67237)
It was discovered that RabbitMQ Server incorrectly handled ETF-encoded PID node names. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67238)
It was discovered that RabbitMQ Server incorrectly handled TLS peer-certificate DNs in the stream management UI. An attacker could possibly use this issue to cause a cross-site scripting attack. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67239)
It was discovered that RabbitMQ Server incorrectly handled OAuth2 SSL options when no CA certificates were available. An attacker could possibly use this issue to bypass TLS verification. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-67404)
It was discovered that RabbitMQ Server incorrectly validated HTTP response status codes when fetching JWKS keys. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67409)
References
{
"affected": [
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2026-66070",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-66077",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-66079",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67231",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67232",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67235",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67236",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67237",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67238",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67239",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67404",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67409",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:Pro:16.04:LTS"
}
},
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.5.7-1ubuntu0.16.04.4+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.7-1ubuntu0.16.04.4+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.5.4-1",
"3.5.4-3",
"3.5.4-3.1",
"3.5.7-1",
"3.5.7-1ubuntu0.16.04.1",
"3.5.7-1ubuntu0.16.04.2",
"3.5.7-1ubuntu0.16.04.4",
"3.5.7-1ubuntu0.16.04.4+esm1",
"3.5.7-1ubuntu0.16.04.4+esm2"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2026-66070",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-66077",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-66079",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67231",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67232",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67235",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67236",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67237",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67238",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67239",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67404",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67409",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:Pro:18.04:LTS"
}
},
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.6.10-1ubuntu0.5+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5+esm1?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.10-1ubuntu0.5+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.6.10-1",
"3.6.10-1ubuntu0.1",
"3.6.10-1ubuntu0.3",
"3.6.10-1ubuntu0.4",
"3.6.10-1ubuntu0.5"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2026-66070",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-66077",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-66079",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67231",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67232",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67235",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67236",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67237",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67238",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67239",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67404",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67409",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:Pro:20.04:LTS"
}
},
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.8.3-0ubuntu0.3+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3+esm2?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3-0ubuntu0.3+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.7.8-4ubuntu2",
"3.7.18-1",
"3.8.2-0ubuntu1",
"3.8.2-0ubuntu1.1",
"3.8.2-0ubuntu1.2",
"3.8.2-0ubuntu1.3",
"3.8.2-0ubuntu1.4",
"3.8.2-0ubuntu1.5",
"3.8.3-0ubuntu0.1",
"3.8.3-0ubuntu0.2",
"3.8.3-0ubuntu0.3",
"3.8.3-0ubuntu0.3+esm1"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2026-66070",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-66077",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-66079",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67231",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67232",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67235",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67236",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67237",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67238",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67239",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67404",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67409",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:22.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.9.27-0ubuntu0.6"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.6?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.27-0ubuntu0.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.8.9-3ubuntu1",
"3.9.8-1",
"3.9.8-2",
"3.9.8-3",
"3.9.8-5",
"3.9.8-6",
"3.9.13-1",
"3.9.13-1ubuntu0.22.04.1",
"3.9.13-1ubuntu0.22.04.2",
"3.9.27-0ubuntu0.1",
"3.9.27-0ubuntu0.2",
"3.9.27-0ubuntu0.5"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2026-66070",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-66077",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-66079",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67231",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67232",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67235",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67236",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67237",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67238",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67239",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67404",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67409",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:24.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.12.1-1ubuntu1.7"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.7?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.1-1ubuntu1.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.1-1",
"3.12.1-1ubuntu1",
"3.12.1-1ubuntu1.2",
"3.12.1-1ubuntu1.4",
"3.12.1-1ubuntu1.6"
]
},
{
"database_specific": {
"cves_map": {
"cves": [
{
"id": "CVE-2026-66070",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-66077",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-66079",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67231",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67232",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67235",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67236",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67237",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67238",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67239",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67404",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
},
{
"id": "CVE-2026-67409",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
]
}
],
"ecosystem": "Ubuntu:26.04:LTS"
}
},
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "4.0.5-10ubuntu5.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5.2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.5-10ubuntu5.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.5-8ubuntu2",
"4.0.5-10ubuntu1",
"4.0.5-10ubuntu2",
"4.0.5-10ubuntu3",
"4.0.5-10ubuntu4",
"4.0.5-10ubuntu5",
"4.0.5-10ubuntu5.1"
]
}
],
"aliases": [],
"details": "It was discovered that RabbitMQ Server incorrectly handled CORS wildcard\norigin configuration. An attacker could possibly use this issue to cause\na cross-site request forgery attack. This issue only affected Ubuntu 18.04\nLTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04\nLTS. (CVE-2026-66070)\n\nIt was discovered that RabbitMQ Server incorrectly handled TLS\npeer-certificate DNs in the management UI. An attacker could possibly use\nthis issue to cause a cross-site scripting attack. (CVE-2026-66077)\n\nIt was discovered that RabbitMQ Server incorrectly handled AMQP 1.0 arrays\nwith zero-width element constructors. An attacker could possibly use this\nissue to cause a denial of service. This issue only affected Ubuntu 20.04\nLTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-66079)\n\nIt was discovered that RabbitMQ Server trust-store plugin incorrectly\nvalidated client certificates. An attacker could possibly use this issue to\nbypass TLS client authentication. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-67231)\n\nIt was discovered that RabbitMQ Server incorrectly handled WebSocket frame\nsizes. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67232)\n\nIt was discovered that RabbitMQ Server incorrectly handled content-header\nbody sizes. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2026-67235)\n\nIt was discovered that RabbitMQ Server incorrectly stored credentials in an\ninsecure cookie. An attacker could possibly use this issue to expose\nsensitive information. This issue only affected Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67236)\n\nIt was discovered that RabbitMQ Server incorrectly handled OAuth bearer\ntokens in bootstrap JavaScript. An attacker could possibly use this issue\nto cause a cross-site scripting attack. This issue only affected Ubuntu\n24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-67237)\n\nIt was discovered that RabbitMQ Server incorrectly handled ETF-encoded PID\nnode names. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and\nUbuntu 26.04 LTS. (CVE-2026-67238)\n\nIt was discovered that RabbitMQ Server incorrectly handled TLS\npeer-certificate DNs in the stream management UI. An attacker could\npossibly use this issue to cause a cross-site scripting attack. This issue\nonly affected Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-67239)\n\nIt was discovered that RabbitMQ Server incorrectly handled OAuth2 SSL\noptions when no CA certificates were available. An attacker could possibly\nuse this issue to bypass TLS verification. This issue only affected Ubuntu\n26.04 LTS. (CVE-2026-67404)\n\nIt was discovered that RabbitMQ Server incorrectly validated HTTP response\nstatus codes when fetching JWKS keys. An attacker could possibly use this\nissue to cause a denial of service. This issue only affected Ubuntu 22.04\nLTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-67409)",
"id": "USN-8933-1",
"modified": "2026-10-15T17:27:24Z",
"published": "2026-10-15T17:27:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8933-1"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-66070"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-66077"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-66079"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67231"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67232"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67235"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67236"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67237"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67238"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67239"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67404"
},
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67409"
}
],
"related": [],
"schema_version": "1.7.0",
"summary": "rabbitmq-server vulnerabilities",
"upstream": [
"UBUNTU-CVE-2026-66070",
"UBUNTU-CVE-2026-66077",
"UBUNTU-CVE-2026-66079",
"UBUNTU-CVE-2026-67231",
"UBUNTU-CVE-2026-67232",
"UBUNTU-CVE-2026-67235",
"UBUNTU-CVE-2026-67236",
"UBUNTU-CVE-2026-67237",
"UBUNTU-CVE-2026-67238",
"UBUNTU-CVE-2026-67239",
"UBUNTU-CVE-2026-67404",
"UBUNTU-CVE-2026-67409"
]
}
UBUNTU-CVE-2026-66070 (CVE-2026-66070)
Vulnerability from osv_ubuntu – Published: 2026-09-23 20:17 – Updated: 2026-10-17 09:48 – Source website
VLAI
Details
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with Access-Control-Allow-Credentials. The affected code is rabbit_mgmt_cors.erl. When the management plugin is configured with a wildcard CORS origin (cors_allow_origins = ""), the handler reflects the request Origin back in Access-Control-Allow-Origin and also sends Access-Control-Allow-Credentials: true. A malicious web page that a signed-in administrator visits can then use that administrator's cached HTTP Basic credentials to issue authenticated, state-changing requests to the management API. Preconditions include The management plugin is configured with the wildcard cors_allow_origins = "*", which is an explicit operator misconfiguration A target administrator has a cached HTTP Basic-auth session in the browser. This issue is fixed in versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6.
Severity
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.5.7-1ubuntu0.16.04.4+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.7-1ubuntu0.16.04.4+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.5.4-1",
"3.5.4-3",
"3.5.4-3.1",
"3.5.7-1",
"3.5.7-1ubuntu0.16.04.1",
"3.5.7-1ubuntu0.16.04.2",
"3.5.7-1ubuntu0.16.04.4",
"3.5.7-1ubuntu0.16.04.4+esm1",
"3.5.7-1ubuntu0.16.04.4+esm2"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.6.10-1ubuntu0.5+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5+esm1?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.10-1ubuntu0.5+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.6.10-1",
"3.6.10-1ubuntu0.1",
"3.6.10-1ubuntu0.3",
"3.6.10-1ubuntu0.4",
"3.6.10-1ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.8.3-0ubuntu0.3+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3+esm2?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3-0ubuntu0.3+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.7.8-4ubuntu2",
"3.7.18-1",
"3.8.2-0ubuntu1",
"3.8.2-0ubuntu1.1",
"3.8.2-0ubuntu1.2",
"3.8.2-0ubuntu1.3",
"3.8.2-0ubuntu1.4",
"3.8.2-0ubuntu1.5",
"3.8.3-0ubuntu0.1",
"3.8.3-0ubuntu0.2",
"3.8.3-0ubuntu0.3",
"3.8.3-0ubuntu0.3+esm1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.9.27-0ubuntu0.6"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.6?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.27-0ubuntu0.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.8.9-3ubuntu1",
"3.9.8-1",
"3.9.8-2",
"3.9.8-3",
"3.9.8-5",
"3.9.8-6",
"3.9.13-1",
"3.9.13-1ubuntu0.22.04.1",
"3.9.13-1ubuntu0.22.04.2",
"3.9.27-0ubuntu0.1",
"3.9.27-0ubuntu0.2",
"3.9.27-0ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.12.1-1ubuntu1.7"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.7?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.1-1ubuntu1.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.1-1",
"3.12.1-1ubuntu1",
"3.12.1-1ubuntu1.2",
"3.12.1-1ubuntu1.4",
"3.12.1-1ubuntu1.6"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "4.0.5-10ubuntu5.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5.2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.5-10ubuntu5.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.5-8ubuntu2",
"4.0.5-10ubuntu1",
"4.0.5-10ubuntu2",
"4.0.5-10ubuntu3",
"4.0.5-10ubuntu4",
"4.0.5-10ubuntu5",
"4.0.5-10ubuntu5.1"
]
}
],
"aliases": [],
"details": "RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard \"\" was configured, so the response echoed the attacker\u0027s origin together with Access-Control-Allow-Credentials. The affected code is rabbit_mgmt_cors.erl. When the management plugin is configured with a wildcard CORS origin (cors_allow_origins = \"\"), the handler reflects the request Origin back in Access-Control-Allow-Origin and also sends Access-Control-Allow-Credentials: true. A malicious web page that a signed-in administrator visits can then use that administrator\u0027s cached HTTP Basic credentials to issue authenticated, state-changing requests to the management API. Preconditions include The management plugin is configured with the wildcard cors_allow_origins = \"*\", which is an explicit operator misconfiguration A target administrator has a cached HTTP Basic-auth session in the browser. This issue is fixed in versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6.",
"id": "UBUNTU-CVE-2026-66070",
"modified": "2026-10-17T09:48:27Z",
"published": "2026-09-23T20:17:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-66070"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66070"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-p3hp-v9wh-ghm7"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8933-1"
}
],
"related": [
"USN-8933-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-66070"
]
}
UBUNTU-CVE-2026-66077 (CVE-2026-66077)
Vulnerability from osv_ubuntu – Published: 2026-09-23 21:16 – Updated: 2026-10-17 09:48 – Source website
VLAI
Details
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... %> does NOT HTML-escape. connection.ejs:135 renders <%= connection.ssl_details.peer_cert_subject %> (and peer_cert_issuer) directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The values come from rabbit_ssl:peer_cert_subject/1 which formats the DN as a string without HTML escaping. The verifier corrected the original researcher's claim: this is reachable only when the listener is configured with verify_peer (so the certificate must be signed by a CA in the broker's trust store, not arbitrary self-signed); however, in deployments using mTLS for client authentication, any user who can request a certificate from the organisational CA controls the Subject CN. An attacker who can obtain a TLS client certificate signed by a CA the broker trusts (with verify_peer enabled) can embed JavaScript in the certificate's Subject DN. When any administrator views that connection in the management UI, the script executes in the admin's browser session, allowing full account takeover (create users, export definitions, etc.). The management UI's CSP includes 'unsafe-inline', so inline script execution is not blocked. Preconditions include TLS listener configured with ssl_options.verify = verify_peer Attacker can obtain a CA-signed client certificate with attacker-chosen Subject (e.g. self-service corporate PKI, or rabbitmq_trust_store plugin in use) Administrator views the connection detail page. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Severity
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.5.7-1ubuntu0.16.04.4+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.7-1ubuntu0.16.04.4+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.5.4-1",
"3.5.4-3",
"3.5.4-3.1",
"3.5.7-1",
"3.5.7-1ubuntu0.16.04.1",
"3.5.7-1ubuntu0.16.04.2",
"3.5.7-1ubuntu0.16.04.4",
"3.5.7-1ubuntu0.16.04.4+esm1",
"3.5.7-1ubuntu0.16.04.4+esm2"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.6.10-1ubuntu0.5+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5+esm1?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.10-1ubuntu0.5+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.6.10-1",
"3.6.10-1ubuntu0.1",
"3.6.10-1ubuntu0.3",
"3.6.10-1ubuntu0.4",
"3.6.10-1ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.8.3-0ubuntu0.3+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3+esm2?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3-0ubuntu0.3+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.7.8-4ubuntu2",
"3.7.18-1",
"3.8.2-0ubuntu1",
"3.8.2-0ubuntu1.1",
"3.8.2-0ubuntu1.2",
"3.8.2-0ubuntu1.3",
"3.8.2-0ubuntu1.4",
"3.8.2-0ubuntu1.5",
"3.8.3-0ubuntu0.1",
"3.8.3-0ubuntu0.2",
"3.8.3-0ubuntu0.3",
"3.8.3-0ubuntu0.3+esm1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.9.27-0ubuntu0.6"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.6?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.27-0ubuntu0.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.8.9-3ubuntu1",
"3.9.8-1",
"3.9.8-2",
"3.9.8-3",
"3.9.8-5",
"3.9.8-6",
"3.9.13-1",
"3.9.13-1ubuntu0.22.04.1",
"3.9.13-1ubuntu0.22.04.2",
"3.9.27-0ubuntu0.1",
"3.9.27-0ubuntu0.2",
"3.9.27-0ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.12.1-1ubuntu1.7"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.7?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.1-1ubuntu1.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.1-1",
"3.12.1-1ubuntu1",
"3.12.1-1ubuntu1.2",
"3.12.1-1ubuntu1.4",
"3.12.1-1ubuntu1.6"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "4.0.5-10ubuntu5.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5.2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.5-10ubuntu5.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.5-8ubuntu2",
"4.0.5-10ubuntu1",
"4.0.5-10ubuntu2",
"4.0.5-10ubuntu3",
"4.0.5-10ubuntu4",
"4.0.5-10ubuntu5",
"4.0.5-10ubuntu5.1"
]
}
],
"aliases": [],
"details": "RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which \u003c%= ... %\u003e does NOT HTML-escape. connection.ejs:135 renders \u003c%= connection.ssl_details.peer_cert_subject %\u003e (and peer_cert_issuer) directly into the page. The same pattern appears in streamConnection.ejs:102,106,110. The values come from rabbit_ssl:peer_cert_subject/1 which formats the DN as a string without HTML escaping. The verifier corrected the original researcher\u0027s claim: this is reachable only when the listener is configured with verify_peer (so the certificate must be signed by a CA in the broker\u0027s trust store, not arbitrary self-signed); however, in deployments using mTLS for client authentication, any user who can request a certificate from the organisational CA controls the Subject CN. An attacker who can obtain a TLS client certificate signed by a CA the broker trusts (with verify_peer enabled) can embed JavaScript in the certificate\u0027s Subject DN. When any administrator views that connection in the management UI, the script executes in the admin\u0027s browser session, allowing full account takeover (create users, export definitions, etc.). The management UI\u0027s CSP includes \u0027unsafe-inline\u0027, so inline script execution is not blocked. Preconditions include TLS listener configured with ssl_options.verify = verify_peer Attacker can obtain a CA-signed client certificate with attacker-chosen Subject (e.g. self-service corporate PKI, or rabbitmq_trust_store plugin in use) Administrator views the connection detail page. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.",
"id": "UBUNTU-CVE-2026-66077",
"modified": "2026-10-17T09:48:27Z",
"published": "2026-09-23T21:16:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-66077"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66077"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rjcf-35r5-xw38"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8933-1"
}
],
"related": [
"USN-8933-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-66077"
]
}
UBUNTU-CVE-2026-66079 (CVE-2026-66079)
Vulnerability from osv_ubuntu – Published: 2026-09-23 20:17 – Updated: 2026-10-17 09:48 – Source website
VLAI
Details
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Severity
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.5.7-1ubuntu0.16.04.4+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.7-1ubuntu0.16.04.4+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.5.4-1",
"3.5.4-3",
"3.5.4-3.1",
"3.5.7-1",
"3.5.7-1ubuntu0.16.04.1",
"3.5.7-1ubuntu0.16.04.2",
"3.5.7-1ubuntu0.16.04.4",
"3.5.7-1ubuntu0.16.04.4+esm1",
"3.5.7-1ubuntu0.16.04.4+esm2"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.6.10-1ubuntu0.5+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5+esm1?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.10-1ubuntu0.5+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.6.10-1",
"3.6.10-1ubuntu0.1",
"3.6.10-1ubuntu0.3",
"3.6.10-1ubuntu0.4",
"3.6.10-1ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.8.3-0ubuntu0.3+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3+esm2?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3-0ubuntu0.3+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.7.8-4ubuntu2",
"3.7.18-1",
"3.8.2-0ubuntu1",
"3.8.2-0ubuntu1.1",
"3.8.2-0ubuntu1.2",
"3.8.2-0ubuntu1.3",
"3.8.2-0ubuntu1.4",
"3.8.2-0ubuntu1.5",
"3.8.3-0ubuntu0.1",
"3.8.3-0ubuntu0.2",
"3.8.3-0ubuntu0.3",
"3.8.3-0ubuntu0.3+esm1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.9.27-0ubuntu0.6"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.6?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.27-0ubuntu0.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.8.9-3ubuntu1",
"3.9.8-1",
"3.9.8-2",
"3.9.8-3",
"3.9.8-5",
"3.9.8-6",
"3.9.13-1",
"3.9.13-1ubuntu0.22.04.1",
"3.9.13-1ubuntu0.22.04.2",
"3.9.27-0ubuntu0.1",
"3.9.27-0ubuntu0.2",
"3.9.27-0ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.12.1-1ubuntu1.7"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.7?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.1-1ubuntu1.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.1-1",
"3.12.1-1ubuntu1",
"3.12.1-1ubuntu1.2",
"3.12.1-1ubuntu1.4",
"3.12.1-1ubuntu1.6"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "4.0.5-10ubuntu5.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5.2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.5-10ubuntu5.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.5-8ubuntu2",
"4.0.5-10ubuntu1",
"4.0.5-10ubuntu2",
"4.0.5-10ubuntu3",
"4.0.5-10ubuntu4",
"4.0.5-10ubuntu5",
"4.0.5-10ubuntu5.1"
]
}
],
"aliases": [],
"details": "RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.",
"id": "UBUNTU-CVE-2026-66079",
"modified": "2026-10-17T09:48:27Z",
"published": "2026-09-23T20:17:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-66079"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-66079"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8933-1"
}
],
"related": [
"USN-8933-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-66079"
]
}
UBUNTU-CVE-2026-67231 (CVE-2026-67231)
Vulnerability from osv_ubuntu – Published: 2026-09-23 21:17 – Updated: 2026-10-17 09:48 – Source website
VLAI
Details
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert "matches" a whitelisted one. The match key is extract_issuer_id/1 → public_key:pkix_issuer_id/2 → {IssuerName, SerialNumber} , both fields are taken verbatim from the presented certificate body and contain no public-key, SKI, fingerprint or signature material. is_whitelisted/1 is a pure ets:member lookup; the stored full DER is used only for list/0 display and is never compared against the presented cert. cacerts is [], so the whitelisted cert is never used as a trust anchor for path validation either. TLS client-authentication bypass: an attacker who knows the issuer DN + serial of any whitelisted certificate can connect with a forged self-signed cert. Preconditions include rabbitmq_trust_store plugin enabled and used as the TLS verify_fun Attacker knows or can guess the {Issuer, Serial} of at least one whitelisted cert (non-secret; exposed via CLI/logs/any cert copy). This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Severity
N/A (UNKNOWN)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.5.7-1ubuntu0.16.04.4+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.7-1ubuntu0.16.04.4+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.5.4-1",
"3.5.4-3",
"3.5.4-3.1",
"3.5.7-1",
"3.5.7-1ubuntu0.16.04.1",
"3.5.7-1ubuntu0.16.04.2",
"3.5.7-1ubuntu0.16.04.4",
"3.5.7-1ubuntu0.16.04.4+esm1",
"3.5.7-1ubuntu0.16.04.4+esm2"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.6.10-1ubuntu0.5+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5+esm1?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.10-1ubuntu0.5+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.6.10-1",
"3.6.10-1ubuntu0.1",
"3.6.10-1ubuntu0.3",
"3.6.10-1ubuntu0.4",
"3.6.10-1ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.8.3-0ubuntu0.3+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3+esm2?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3-0ubuntu0.3+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.7.8-4ubuntu2",
"3.7.18-1",
"3.8.2-0ubuntu1",
"3.8.2-0ubuntu1.1",
"3.8.2-0ubuntu1.2",
"3.8.2-0ubuntu1.3",
"3.8.2-0ubuntu1.4",
"3.8.2-0ubuntu1.5",
"3.8.3-0ubuntu0.1",
"3.8.3-0ubuntu0.2",
"3.8.3-0ubuntu0.3",
"3.8.3-0ubuntu0.3+esm1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.9.27-0ubuntu0.6"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.6?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.27-0ubuntu0.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.8.9-3ubuntu1",
"3.9.8-1",
"3.9.8-2",
"3.9.8-3",
"3.9.8-5",
"3.9.8-6",
"3.9.13-1",
"3.9.13-1ubuntu0.22.04.1",
"3.9.13-1ubuntu0.22.04.2",
"3.9.27-0ubuntu0.1",
"3.9.27-0ubuntu0.2",
"3.9.27-0ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.12.1-1ubuntu1.7"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.7?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.1-1ubuntu1.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.1-1",
"3.12.1-1ubuntu1",
"3.12.1-1ubuntu1.2",
"3.12.1-1ubuntu1.4",
"3.12.1-1ubuntu1.6"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "4.0.5-10ubuntu5.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5.2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.5-10ubuntu5.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.5-8ubuntu2",
"4.0.5-10ubuntu1",
"4.0.5-10ubuntu2",
"4.0.5-10ubuntu3",
"4.0.5-10ubuntu4",
"4.0.5-10ubuntu5",
"4.0.5-10ubuntu5.1"
]
}
],
"aliases": [],
"details": "RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer} when the presented cert \"matches\" a whitelisted one. The match key is extract_issuer_id/1 \u2192 public_key:pkix_issuer_id/2 \u2192 {IssuerName, SerialNumber} , both fields are taken verbatim from the presented certificate body and contain no public-key, SKI, fingerprint or signature material. is_whitelisted/1 is a pure ets:member lookup; the stored full DER is used only for list/0 display and is never compared against the presented cert. cacerts is [], so the whitelisted cert is never used as a trust anchor for path validation either. TLS client-authentication bypass: an attacker who knows the issuer DN + serial of any whitelisted certificate can connect with a forged self-signed cert. Preconditions include rabbitmq_trust_store plugin enabled and used as the TLS verify_fun Attacker knows or can guess the {Issuer, Serial} of at least one whitelisted cert (non-secret; exposed via CLI/logs/any cert copy). This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.",
"id": "UBUNTU-CVE-2026-67231",
"modified": "2026-10-17T09:48:28Z",
"published": "2026-09-23T21:17:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67231"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67231"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-cw8c-4m83-9c6w"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8933-1"
}
],
"related": [
"USN-8933-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-67231"
]
}
UBUNTU-CVE-2026-67232 (CVE-2026-67232)
Vulnerability from osv_ubuntu – Published: 2026-09-23 21:17 – Updated: 2026-10-17 09:48 – Source website
VLAI
Details
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress => true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max_frame_size, so cowboy's default of infinity applies. cowlib's cow_ws:parse_payload/9 calls zlib:inflate/2 on the compressed payload with no output-size limit. An attacker can negotiate permessage-deflate during the WebSocket upgrade and send a frame containing a zlib bomb (e.g. 50 KB → 5 GB). Decompression occurs in the connection process before websocket_handle/2 ever sees the MQTT bytes. An unauthenticated attacker can crash a RabbitMQ node running the Web-MQTT plugin by sending a single highly-compressed WebSocket frame (a few KB on the wire) that inflates to gigabytes in memory. The cowboy WebSocket handler decompresses the entire frame before the MQTT CONNECT packet is processed, so no credentials are required. Preconditions include rabbitmq_web_mqtt plugin enabled (not default, but common for browser clients) Network reachability to port 15675/15676 No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Severity
N/A (UNKNOWN)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.5.7-1ubuntu0.16.04.4+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.7-1ubuntu0.16.04.4+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.5.4-1",
"3.5.4-3",
"3.5.4-3.1",
"3.5.7-1",
"3.5.7-1ubuntu0.16.04.1",
"3.5.7-1ubuntu0.16.04.2",
"3.5.7-1ubuntu0.16.04.4",
"3.5.7-1ubuntu0.16.04.4+esm1",
"3.5.7-1ubuntu0.16.04.4+esm2"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.6.10-1ubuntu0.5+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5+esm1?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.10-1ubuntu0.5+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.6.10-1",
"3.6.10-1ubuntu0.1",
"3.6.10-1ubuntu0.3",
"3.6.10-1ubuntu0.4",
"3.6.10-1ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.8.3-0ubuntu0.3+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3+esm2?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3-0ubuntu0.3+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.7.8-4ubuntu2",
"3.7.18-1",
"3.8.2-0ubuntu1",
"3.8.2-0ubuntu1.1",
"3.8.2-0ubuntu1.2",
"3.8.2-0ubuntu1.3",
"3.8.2-0ubuntu1.4",
"3.8.2-0ubuntu1.5",
"3.8.3-0ubuntu0.1",
"3.8.3-0ubuntu0.2",
"3.8.3-0ubuntu0.3",
"3.8.3-0ubuntu0.3+esm1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.9.27-0ubuntu0.6"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.6?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.27-0ubuntu0.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.8.9-3ubuntu1",
"3.9.8-1",
"3.9.8-2",
"3.9.8-3",
"3.9.8-5",
"3.9.8-6",
"3.9.13-1",
"3.9.13-1ubuntu0.22.04.1",
"3.9.13-1ubuntu0.22.04.2",
"3.9.27-0ubuntu0.1",
"3.9.27-0ubuntu0.2",
"3.9.27-0ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.12.1-1ubuntu1.7"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.7?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.1-1ubuntu1.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.1-1",
"3.12.1-1ubuntu1",
"3.12.1-1ubuntu1.2",
"3.12.1-1ubuntu1.4",
"3.12.1-1ubuntu1.6"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "4.0.5-10ubuntu5.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5.2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.5-10ubuntu5.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.5-8ubuntu2",
"4.0.5-10ubuntu1",
"4.0.5-10ubuntu2",
"4.0.5-10ubuntu3",
"4.0.5-10ubuntu4",
"4.0.5-10ubuntu5",
"4.0.5-10ubuntu5.1"
]
}
],
"aliases": [],
"details": "RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress =\u003e true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max_frame_size, so cowboy\u0027s default of infinity applies. cowlib\u0027s cow_ws:parse_payload/9 calls zlib:inflate/2 on the compressed payload with no output-size limit. An attacker can negotiate permessage-deflate during the WebSocket upgrade and send a frame containing a zlib bomb (e.g. 50 KB \u2192 5 GB). Decompression occurs in the connection process before websocket_handle/2 ever sees the MQTT bytes. An unauthenticated attacker can crash a RabbitMQ node running the Web-MQTT plugin by sending a single highly-compressed WebSocket frame (a few KB on the wire) that inflates to gigabytes in memory. The cowboy WebSocket handler decompresses the entire frame before the MQTT CONNECT packet is processed, so no credentials are required. Preconditions include rabbitmq_web_mqtt plugin enabled (not default, but common for browser clients) Network reachability to port 15675/15676 No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.",
"id": "UBUNTU-CVE-2026-67232",
"modified": "2026-10-17T09:48:28Z",
"published": "2026-09-23T21:17:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67232"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67232"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gmgx-hhg5-43gr"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8933-1"
}
],
"related": [
"USN-8933-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-67232"
]
}
UBUNTU-CVE-2026-67235 (CVE-2026-67235)
Vulnerability from osv_ubuntu – Published: 2026-09-23 21:17 – Updated: 2026-10-17 09:48 – Source website
VLAI
Details
RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize (a uint64) was stored without validation against max_message_size. The size check ran only when assembly completed. By declaring body_size = 2^63-1 and then streaming fragments, a client ensured that check_msg_size never fired, so the accumulated body size went unbounded. A reader process accumulates memory until the memory alarm fires, degrading all publishers cluster-wide, or until the node runs out of memory. The memory alarm provides only partial mitigation, since it is reactive rather than preventive. AMQP 0-9-1 is the most widely used protocol, and any publisher can trigger this condition. Preconditions include Any authenticated AMQP 0-9-1 client with publish permission can exploit this.. This issue is fixed in versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15.
Severity
N/A (UNKNOWN)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.5.7-1ubuntu0.16.04.4+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.7-1ubuntu0.16.04.4+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.5.4-1",
"3.5.4-3",
"3.5.4-3.1",
"3.5.7-1",
"3.5.7-1ubuntu0.16.04.1",
"3.5.7-1ubuntu0.16.04.2",
"3.5.7-1ubuntu0.16.04.4",
"3.5.7-1ubuntu0.16.04.4+esm1",
"3.5.7-1ubuntu0.16.04.4+esm2"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.6.10-1ubuntu0.5+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5+esm1?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.10-1ubuntu0.5+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.6.10-1",
"3.6.10-1ubuntu0.1",
"3.6.10-1ubuntu0.3",
"3.6.10-1ubuntu0.4",
"3.6.10-1ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.8.3-0ubuntu0.3+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3+esm2?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3-0ubuntu0.3+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.7.8-4ubuntu2",
"3.7.18-1",
"3.8.2-0ubuntu1",
"3.8.2-0ubuntu1.1",
"3.8.2-0ubuntu1.2",
"3.8.2-0ubuntu1.3",
"3.8.2-0ubuntu1.4",
"3.8.2-0ubuntu1.5",
"3.8.3-0ubuntu0.1",
"3.8.3-0ubuntu0.2",
"3.8.3-0ubuntu0.3",
"3.8.3-0ubuntu0.3+esm1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.9.27-0ubuntu0.6"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.6?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.27-0ubuntu0.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.8.9-3ubuntu1",
"3.9.8-1",
"3.9.8-2",
"3.9.8-3",
"3.9.8-5",
"3.9.8-6",
"3.9.13-1",
"3.9.13-1ubuntu0.22.04.1",
"3.9.13-1ubuntu0.22.04.2",
"3.9.27-0ubuntu0.1",
"3.9.27-0ubuntu0.2",
"3.9.27-0ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.12.1-1ubuntu1.7"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.7?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.1-1ubuntu1.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.1-1",
"3.12.1-1ubuntu1",
"3.12.1-1ubuntu1.2",
"3.12.1-1ubuntu1.4",
"3.12.1-1ubuntu1.6"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "4.0.5-10ubuntu5.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5.2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.5-10ubuntu5.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.5-8ubuntu2",
"4.0.5-10ubuntu1",
"4.0.5-10ubuntu2",
"4.0.5-10ubuntu3",
"4.0.5-10ubuntu4",
"4.0.5-10ubuntu5",
"4.0.5-10ubuntu5.1"
]
}
],
"aliases": [],
"details": "RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize (a uint64) was stored without validation against max_message_size. The size check ran only when assembly completed. By declaring body_size = 2^63-1 and then streaming fragments, a client ensured that check_msg_size never fired, so the accumulated body size went unbounded. A reader process accumulates memory until the memory alarm fires, degrading all publishers cluster-wide, or until the node runs out of memory. The memory alarm provides only partial mitigation, since it is reactive rather than preventive. AMQP 0-9-1 is the most widely used protocol, and any publisher can trigger this condition. Preconditions include Any authenticated AMQP 0-9-1 client with publish permission can exploit this.. This issue is fixed in versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15.",
"id": "UBUNTU-CVE-2026-67235",
"modified": "2026-10-17T09:48:28Z",
"published": "2026-09-23T21:17:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67235"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67235"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-q8g2-pc7m-m3jw"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8933-1"
}
],
"related": [
"USN-8933-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-67235"
]
}
UBUNTU-CVE-2026-67236 (CVE-2026-67236)
Vulnerability from osv_ubuntu – Published: 2026-09-25 16:17 – Updated: 2026-10-17 09:48 – Source website
VLAI
Details
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2.
Severity
6.5 (Medium)
N/A (UNKNOWN)
References
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.5.7-1ubuntu0.16.04.4+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.7-1ubuntu0.16.04.4+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.5.4-1",
"3.5.4-3",
"3.5.4-3.1",
"3.5.7-1",
"3.5.7-1ubuntu0.16.04.1",
"3.5.7-1ubuntu0.16.04.2",
"3.5.7-1ubuntu0.16.04.4",
"3.5.7-1ubuntu0.16.04.4+esm1",
"3.5.7-1ubuntu0.16.04.4+esm2"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.6.10-1ubuntu0.5+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5+esm1?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.10-1ubuntu0.5+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.6.10-1",
"3.6.10-1ubuntu0.1",
"3.6.10-1ubuntu0.3",
"3.6.10-1ubuntu0.4",
"3.6.10-1ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.8.3-0ubuntu0.3+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3+esm2?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3-0ubuntu0.3+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.7.8-4ubuntu2",
"3.7.18-1",
"3.8.2-0ubuntu1",
"3.8.2-0ubuntu1.1",
"3.8.2-0ubuntu1.2",
"3.8.2-0ubuntu1.3",
"3.8.2-0ubuntu1.4",
"3.8.2-0ubuntu1.5",
"3.8.3-0ubuntu0.1",
"3.8.3-0ubuntu0.2",
"3.8.3-0ubuntu0.3",
"3.8.3-0ubuntu0.3+esm1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.9.27-0ubuntu0.6"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.6?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.27-0ubuntu0.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.8.9-3ubuntu1",
"3.9.8-1",
"3.9.8-2",
"3.9.8-3",
"3.9.8-5",
"3.9.8-6",
"3.9.13-1",
"3.9.13-1ubuntu0.22.04.1",
"3.9.13-1ubuntu0.22.04.2",
"3.9.27-0ubuntu0.1",
"3.9.27-0ubuntu0.2",
"3.9.27-0ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.12.1-1ubuntu1.7"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.7?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.1-1ubuntu1.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.1-1",
"3.12.1-1ubuntu1",
"3.12.1-1ubuntu1.2",
"3.12.1-1ubuntu1.4",
"3.12.1-1ubuntu1.6"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "4.0.5-10ubuntu5.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5.2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.5-10ubuntu5.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.5-8ubuntu2",
"4.0.5-10ubuntu1",
"4.0.5-10ubuntu2",
"4.0.5-10ubuntu3",
"4.0.5-10ubuntu4",
"4.0.5-10ubuntu5",
"4.0.5-10ubuntu5.1"
]
}
],
"aliases": [],
"details": "RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2.",
"id": "UBUNTU-CVE-2026-67236",
"modified": "2026-10-17T09:48:28Z",
"published": "2026-09-25T16:17:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67236"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67236"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-88vh-gx85-p36m"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/df9e7f4c0afd311a672705f020d301efad355745"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/edf1fbc7217aaf736955d2e13c9534901a2e0778"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8933-1"
}
],
"related": [
"USN-8933-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-67236"
]
}
UBUNTU-CVE-2026-67237 (CVE-2026-67237)
Vulnerability from osv_ubuntu – Published: 2026-09-25 17:17 – Updated: 2026-10-17 09:48 – Source website
VLAI
Details
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. The endpoint is exposed before authentication only when management.oauth_enabled is true, and exploitation through the cookie path additionally requires the attacker to plant an access_token cookie on the management host. This issue is fixed in versions 4.2.8 and 4.3.2.
Severity
N/A (UNKNOWN)
References
| URL | Type | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.5.7-1ubuntu0.16.04.4+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.7-1ubuntu0.16.04.4+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.5.4-1",
"3.5.4-3",
"3.5.4-3.1",
"3.5.7-1",
"3.5.7-1ubuntu0.16.04.1",
"3.5.7-1ubuntu0.16.04.2",
"3.5.7-1ubuntu0.16.04.4",
"3.5.7-1ubuntu0.16.04.4+esm1",
"3.5.7-1ubuntu0.16.04.4+esm2"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.6.10-1ubuntu0.5+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5+esm1?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.10-1ubuntu0.5+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.6.10-1",
"3.6.10-1ubuntu0.1",
"3.6.10-1ubuntu0.3",
"3.6.10-1ubuntu0.4",
"3.6.10-1ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.8.3-0ubuntu0.3+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3+esm2?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3-0ubuntu0.3+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.7.8-4ubuntu2",
"3.7.18-1",
"3.8.2-0ubuntu1",
"3.8.2-0ubuntu1.1",
"3.8.2-0ubuntu1.2",
"3.8.2-0ubuntu1.3",
"3.8.2-0ubuntu1.4",
"3.8.2-0ubuntu1.5",
"3.8.3-0ubuntu0.1",
"3.8.3-0ubuntu0.2",
"3.8.3-0ubuntu0.3",
"3.8.3-0ubuntu0.3+esm1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.9.27-0ubuntu0.6"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.6?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.27-0ubuntu0.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.8.9-3ubuntu1",
"3.9.8-1",
"3.9.8-2",
"3.9.8-3",
"3.9.8-5",
"3.9.8-6",
"3.9.13-1",
"3.9.13-1ubuntu0.22.04.1",
"3.9.13-1ubuntu0.22.04.2",
"3.9.27-0ubuntu0.1",
"3.9.27-0ubuntu0.2",
"3.9.27-0ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.12.1-1ubuntu1.7"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.7?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.1-1ubuntu1.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.1-1",
"3.12.1-1ubuntu1",
"3.12.1-1ubuntu1.2",
"3.12.1-1ubuntu1.4",
"3.12.1-1ubuntu1.6"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "4.0.5-10ubuntu5.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5.2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.5-10ubuntu5.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.5-8ubuntu2",
"4.0.5-10ubuntu1",
"4.0.5-10ubuntu2",
"4.0.5-10ubuntu3",
"4.0.5-10ubuntu4",
"4.0.5-10ubuntu5",
"4.0.5-10ubuntu5.1"
]
}
],
"aliases": [],
"details": "RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization header or access_token cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the management UI origin. The endpoint is exposed before authentication only when management.oauth_enabled is true, and exploitation through the cookie path additionally requires the attacker to plant an access_token cookie on the management host. This issue is fixed in versions 4.2.8 and 4.3.2.",
"id": "UBUNTU-CVE-2026-67237",
"modified": "2026-10-17T09:48:28Z",
"published": "2026-09-25T17:17:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67237"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67237"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2rf7-f6r6-8rwh"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/5cd6d841d84450324a4613501ed917d98828af23"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/commit/a8041d528c1a71af4cb75ade247ed082fe6b83fb"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.8"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.2"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8933-1"
}
],
"related": [
"USN-8933-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-67237"
]
}
UBUNTU-CVE-2026-67238 (CVE-2026-67238)
Vulnerability from osv_ubuntu – Published: 2026-09-23 20:17 – Updated: 2026-10-17 09:48 – Source website
VLAI
Details
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name / routing key beginning amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). binary_to_existing_atom is not used. Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests. Preconditions include Authenticated AMQP 0-9-1 connection to any vhost No per-connection rate limit low enough to make ~1M operations infeasible. This issue is fixed in versions 4.2.7 and 4.3.1.
Severity
N/A (UNKNOWN)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.5.7-1ubuntu0.16.04.4+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.7-1ubuntu0.16.04.4+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.5.4-1",
"3.5.4-3",
"3.5.4-3.1",
"3.5.7-1",
"3.5.7-1ubuntu0.16.04.1",
"3.5.7-1ubuntu0.16.04.2",
"3.5.7-1ubuntu0.16.04.4",
"3.5.7-1ubuntu0.16.04.4+esm1",
"3.5.7-1ubuntu0.16.04.4+esm2"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.6.10-1ubuntu0.5+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5+esm1?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.10-1ubuntu0.5+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.6.10-1",
"3.6.10-1ubuntu0.1",
"3.6.10-1ubuntu0.3",
"3.6.10-1ubuntu0.4",
"3.6.10-1ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.8.3-0ubuntu0.3+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3+esm2?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3-0ubuntu0.3+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.7.8-4ubuntu2",
"3.7.18-1",
"3.8.2-0ubuntu1",
"3.8.2-0ubuntu1.1",
"3.8.2-0ubuntu1.2",
"3.8.2-0ubuntu1.3",
"3.8.2-0ubuntu1.4",
"3.8.2-0ubuntu1.5",
"3.8.3-0ubuntu0.1",
"3.8.3-0ubuntu0.2",
"3.8.3-0ubuntu0.3",
"3.8.3-0ubuntu0.3+esm1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.9.27-0ubuntu0.6"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.6?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.27-0ubuntu0.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.8.9-3ubuntu1",
"3.9.8-1",
"3.9.8-2",
"3.9.8-3",
"3.9.8-5",
"3.9.8-6",
"3.9.13-1",
"3.9.13-1ubuntu0.22.04.1",
"3.9.13-1ubuntu0.22.04.2",
"3.9.27-0ubuntu0.1",
"3.9.27-0ubuntu0.2",
"3.9.27-0ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.12.1-1ubuntu1.7"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.7?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.1-1ubuntu1.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.1-1",
"3.12.1-1ubuntu1",
"3.12.1-1ubuntu1.2",
"3.12.1-1ubuntu1.4",
"3.12.1-1ubuntu1.6"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "4.0.5-10ubuntu5.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5.2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.5-10ubuntu5.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.5-8ubuntu2",
"4.0.5-10ubuntu1",
"4.0.5-10ubuntu2",
"4.0.5-10ubuntu3",
"4.0.5-10ubuntu4",
"4.0.5-10ubuntu5",
"4.0.5-10ubuntu5.1"
]
}
],
"aliases": [],
"details": "RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name / routing key beginning amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC\u0027d). binary_to_existing_atom is not used. Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests. Preconditions include Authenticated AMQP 0-9-1 connection to any vhost No per-connection rate limit low enough to make ~1M operations infeasible. This issue is fixed in versions 4.2.7 and 4.3.1.",
"id": "UBUNTU-CVE-2026-67238",
"modified": "2026-10-17T09:48:28Z",
"published": "2026-09-23T20:17:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67238"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67238"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x96j-244m-mrr2"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8933-1"
}
],
"related": [
"USN-8933-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-67238"
]
}
UBUNTU-CVE-2026-67239 (CVE-2026-67239)
Vulnerability from osv_ubuntu – Published: 2026-09-25 17:17 – Updated: 2026-10-17 09:48 – Source website
VLAI
Details
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI (sibling of V-11). lines 102/106/110 render peercertsubject / peercertissuer with raw <%= %> and no fmtstring(). RFC4514 backslash-escaping of </> is HTML-inert and bypassable (). Requires non-default config: a stream TLS listener with verifypeer and an attacker-obtainable trusted cert with a malicious Same as the connection.ejs finding, against operators viewing the stream-connection detail rabbitmqstream + rabbitmqstreammanagement enabled with a TLS listener using verifypeer Attacker can obtain a certificate signed by a CA the listener trusts, with attacker-chosen DN An operator views the. This issue is fixed in versions 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3.
Severity
N/A (UNKNOWN)
References
| URL | Type | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.5.7-1ubuntu0.16.04.4+esm3"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:16.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.5.7-1ubuntu0.16.04.4+esm3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.5.4-1",
"3.5.4-3",
"3.5.4-3.1",
"3.5.7-1",
"3.5.7-1ubuntu0.16.04.1",
"3.5.7-1ubuntu0.16.04.2",
"3.5.7-1ubuntu0.16.04.4",
"3.5.7-1ubuntu0.16.04.4+esm1",
"3.5.7-1ubuntu0.16.04.4+esm2"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.6.10-1ubuntu0.5+esm1"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:18.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5+esm1?arch=source\u0026distro=esm-infra/bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.6.10-1ubuntu0.5+esm1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.6.10-1",
"3.6.10-1ubuntu0.1",
"3.6.10-1ubuntu0.3",
"3.6.10-1ubuntu0.4",
"3.6.10-1ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.8.3-0ubuntu0.3+esm2"
}
]
},
"package": {
"ecosystem": "Ubuntu:Pro:20.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3+esm2?arch=source\u0026distro=esm-infra/focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.8.3-0ubuntu0.3+esm2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.7.8-4ubuntu2",
"3.7.18-1",
"3.8.2-0ubuntu1",
"3.8.2-0ubuntu1.1",
"3.8.2-0ubuntu1.2",
"3.8.2-0ubuntu1.3",
"3.8.2-0ubuntu1.4",
"3.8.2-0ubuntu1.5",
"3.8.3-0ubuntu0.1",
"3.8.3-0ubuntu0.2",
"3.8.3-0ubuntu0.3",
"3.8.3-0ubuntu0.3+esm1"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.9.27-0ubuntu0.6"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.6?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.27-0ubuntu0.6"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.8.9-3ubuntu1",
"3.9.8-1",
"3.9.8-2",
"3.9.8-3",
"3.9.8-5",
"3.9.8-6",
"3.9.13-1",
"3.9.13-1ubuntu0.22.04.1",
"3.9.13-1ubuntu0.22.04.2",
"3.9.27-0ubuntu0.1",
"3.9.27-0ubuntu0.2",
"3.9.27-0ubuntu0.5"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "3.12.1-1ubuntu1.7"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.7?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12.1-1ubuntu1.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.12.1-1",
"3.12.1-1ubuntu1",
"3.12.1-1ubuntu1.2",
"3.12.1-1ubuntu1.4",
"3.12.1-1ubuntu1.6"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "4.3.2-4ubuntu3"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.10",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@4.3.2-4ubuntu3?arch=source\u0026distro=stonking"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.5-10ubuntu5",
"4.3.2-4ubuntu2",
"4.3.2-4ubuntu3"
]
},
{
"ecosystem_specific": {
"availability": "No subscription required",
"binaries": [
{
"binary_name": "rabbitmq-server",
"binary_version": "4.0.5-10ubuntu5.2"
}
]
},
"package": {
"ecosystem": "Ubuntu:26.04:LTS",
"name": "rabbitmq-server",
"purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5.2?arch=source\u0026distro=resolute"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.5-10ubuntu5.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"4.0.5-8ubuntu2",
"4.0.5-10ubuntu1",
"4.0.5-10ubuntu2",
"4.0.5-10ubuntu3",
"4.0.5-10ubuntu4",
"4.0.5-10ubuntu5",
"4.0.5-10ubuntu5.1"
]
}
],
"aliases": [],
"details": "RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI (sibling of V-11). lines 102/106/110 render peercertsubject / peercertissuer with raw \u003c%= %\u003e and no fmtstring(). RFC4514 backslash-escaping of \u003c/\u003e is HTML-inert and bypassable (\u003cimg ... //\u003e). Requires non-default config: a stream TLS listener with verifypeer and an attacker-obtainable trusted cert with a malicious Same as the connection.ejs finding, against operators viewing the stream-connection detail rabbitmqstream + rabbitmqstreammanagement enabled with a TLS listener using verifypeer Attacker can obtain a certificate signed by a CA the listener trusts, with attacker-chosen DN An operator views the. This issue is fixed in versions 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3.",
"id": "UBUNTU-CVE-2026-67239",
"modified": "2026-10-17T09:48:28Z",
"published": "2026-09-25T17:17:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2026-67239"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-67239"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-xm9p-57xv-vxwc"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9"
},
{
"type": "REPORT",
"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3"
},
{
"type": "ADVISORY",
"url": "https://ubuntu.com/security/notices/USN-8933-1"
}
],
"related": [
"USN-8933-1"
],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2026-67239"
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.