RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
CVSS Details
- CVSS 3.1 Base Score: 4.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade rabbitmq-server | Dec 4, 2023 | Oct 25, 2023 |
| Suse | — | Upgrade erlang-rabbitmq-client313Upgrade erlang26-wxUpgrade erlang26-observerUpgrade erlang26-debuggerUpgrade erlang26-etUpgrade erlang26-reltool-srcUpgrade erlang26-jinterfaceUpgrade erlang26-reltoolUpgrade erlang26-et-srcUpgrade erlang-rabbitmq-clientUpgrade erlang26-jinterface-srcUpgrade erlang26-observer-srcUpgrade rabbitmq-server313-pluginsUpgrade elixir115Upgrade rabbitmq-server-pluginsUpgrade erlang26Upgrade erlang26-debugger-srcUpgrade erlang26-diameterUpgrade elixir115-docUpgrade erlang26-dialyzer-srcUpgrade erlang26-srcUpgrade erlang26-docUpgrade erlang26-wx-srcUpgrade rabbitmq-server313Upgrade erlang26-dialyzerUpgrade erlang26-epmdUpgrade erlang26-diameter-srcUpgrade rabbitmq-server | Dec 21, 2023 | Oct 25, 2023 |
| Ubuntu | — | Upgrade rabbitmq-server | Nov 22, 2023 | Oct 25, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub