RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Affected: openEuler:20.03-LTS-SP4: rabbitmq-server

RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker. Security Fix(es):

RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.(CVE-2021-22116)

RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange to execute JavaScript in another user's browser. This issue is fixed in version 4.2.5.(CVE-2026-57214)

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ allows foreign bindings to amq.rabbitmq.reply-to destinations because volatile direct-reply-to queues can be accepted at bind and route time but are missing from Khepri-backed deletion checks, leaving persistent route entries after unbind. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.(CVE-2026-57215)

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol auth…

Security update for rabbitmq-server

rabbitmq: RabbitMQ: Information disclosure via path validation bypass in management plugin rabbitmq-server: RabbitMQ: Denial of Service via oversized JSON bodies in HTTP API rabbitmq-server: RabbitMQ: Information Disclosure via Cross-Site Scripting in Federation Management RabbitMQ: RabbitMQ: Cross-site Scripting in management UI allows arbitrary JavaScript execution RabbitMQ: RabbitMQ: Persistent foreign bindings allow unauthorized message routing rabbitmq: RabbitMQ: Authentication bypass allows remote connection for loopback-restricted users via incorrect loopback check rabbitmq: RabbitMQ: Authorization bypass allows unauthorized topic writes and binds during metadata-store failures rabbitmq-server: RabbitMQ: Information disclosure due to improper consumer reauthorization RabbitMQ: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint rabbitmq-server: RabbitMQ: Denial of Service via oversized stream frames RabbitMQ: RabbitMQ: Information disclosure via authorization bypass in AMQP 0-9-1 operations

Security update for rabbitmq-server

Affected: Ubuntu:Pro:16.04:LTS: rabbitmq-server, Ubuntu:18.04:LTS: rabbitmq-server, Ubuntu:20.04:LTS: rabbitmq-server, Ubuntu:22.04:LTS: rabbitmq-server, Ubuntu:24.04:LTS: rabbitmq-server, Ubuntu:26.04:LTS: rabbitmq-server

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authentication can allow a loopback-restricted user such as guest to connect remotely when traffic is accepted through a trusted PROXY-protocol path and the backend listener is loopback-bound because the loopback check uses the listener-side socket address instead of the real client source. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Ein Angreifer kann mehrere Schwachstellen in RabbitMQ ausnutzen, um einen Denial-of-Service-Zustand zu verursachen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen, was möglicherweise weitere Angriffe ermöglicht.