https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:46:12 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-02584 bdu:2024-02584 https://cve.radiocsirt.org/vuln/bdu:2024-02584 https://cve.radiocsirt.org/vuln/bit-rabbitmq-2023-46118 <p><strong>Affected:</strong> Bitnami: rabbitmq</p> <p>RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an &#34;out-of-memory killer&#34;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.</p> <p><strong>Affected:</strong> Bitnami: rabbitmq</p> <p>RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an &#34;out-of-memory killer&#34;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.</p> https://cve.radiocsirt.org/vuln/bit-rabbitmq-2023-46118 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0886 certfr-2023-avi-0886 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0886 https://cve.radiocsirt.org/vuln/euvd-2026-216902 EUVD-2026-216902 https://cve.radiocsirt.org/vuln/euvd-2026-216902 https://cve.radiocsirt.org/vuln/fkie_cve-2023-46118 <p>RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an &#34;out-of-memory killer&#34;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.</p> <p>RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an &#34;out-of-memory killer&#34;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-46118 https://cve.radiocsirt.org/vuln/ghsa-w6cq-9cf4-gqpg <p><strong>Affected:</strong> Hex: rabbit_common</p> <p>### Summary</p> <p>Responsibly disclosed by @NSEcho.</p> <p>HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages.</p> <p>### Details</p> <p>An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an &#34;out-of-memory killer&#34;-like mechanism.</p> <p>A PoC was provided to Team RabbitMQ privately.</p> <p>### Impact</p> <p>Denial of Service</p> <p><strong>Affected:</strong> Hex: rabbit_common</p> <p>### Summary</p> <p>Responsibly disclosed by @NSEcho.</p> <p>HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages.</p> <p>### Details</p> <p>An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an &#34;out-of-memory killer&#34;-like mechanism.</p> <p>A PoC was provided to Team RabbitMQ privately.</p> <p>### Impact</p> <p>Denial of Service</p> https://cve.radiocsirt.org/vuln/ghsa-w6cq-9cf4-gqpg https://cve.radiocsirt.org/vuln/gsd-2023-46118 gsd-2023-46118 https://cve.radiocsirt.org/vuln/gsd-2023-46118 https://cve.radiocsirt.org/vuln/msrc_cve-2023-46118 msrc_CVE-2023-46118 https://cve.radiocsirt.org/vuln/msrc_cve-2023-46118 https://cve.radiocsirt.org/vuln/oesa-2026-4028 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: rabbitmq-server</p> <p>RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker. Security Fix(es):</p> <p>RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an &amp;quot;out-of-memory killer&amp;quot;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.(CVE-2023-46118)</p> <p>RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: rabbitmq-server</p> <p>RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker. Security Fix(es):</p> <p>RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an &amp;quot;out-of-memory killer&amp;quot;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.(CVE-2023-46118)</p> <p>RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in…</p> https://cve.radiocsirt.org/vuln/oesa-2026-4028 https://cve.radiocsirt.org/vuln/rhsa-2024:0217 <p>rabbitmq-server: DoS by publishing large messages over the HTTP API</p> <p>rabbitmq-server: DoS by publishing large messages over the HTTP API</p> https://cve.radiocsirt.org/vuln/rhsa-2024:0217 https://cve.radiocsirt.org/vuln/suse-fu-2024:2078-1 <p>Feature update for rabbitmq-server313, erlang26, elixir115</p> <p>Feature update for rabbitmq-server313, erlang26, elixir115</p> https://cve.radiocsirt.org/vuln/suse-fu-2024:2078-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-46118 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: rabbitmq-server, Ubuntu:18.04:LTS: rabbitmq-server, Ubuntu:20.04:LTS: rabbitmq-server, Ubuntu:22.04:LTS: rabbitmq-server, Ubuntu:24.04:LTS: rabbitmq-server</p> <p>RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an &#34;out-of-memory killer&#34;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: rabbitmq-server, Ubuntu:18.04:LTS: rabbitmq-server, Ubuntu:20.04:LTS: rabbitmq-server, Ubuntu:22.04:LTS: rabbitmq-server, Ubuntu:24.04:LTS: rabbitmq-server</p> <p>RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an &#34;out-of-memory killer&#34;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-46118 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2761 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in RabbitMQ ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in RabbitMQ ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2761