What is the CVSS score of CVE-2023-46118?

CVE-2023-46118 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 1.1%.

Is there a patch available for CVE-2023-46118?

Yes, a patch is available for CVE-2023-46118. Update the affected software to the latest version immediately.

Red Hat CVE-2023-46118

EUVD-2023-50377 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-06-30 https://github.com/rabbitmq/rabbitmq-server

GHSA-w6cq-9cf4-gqpg

Denial Of Service Red Hat Suse

4.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

SUSE

MEDIUM

qualitative

Red Hat

4.9 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 30, 2026 - 18:01 EUVD

CVE Published

Jun 30, 2026 - 16:39 github-advisory

MEDIUM 4.9

DescriptionGitHub Advisory

Summary

Responsibly disclosed by @NSEcho.

HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages.

Details

An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism.

A PoC was provided to Team RabbitMQ privately.

Impact

Denial of Service

AnalysisAI

Summary Responsibly disclosed by @NSEcho. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Technical ContextAI

This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), which allows attackers to cause denial of service by exhausting system resources.

Summary Responsibly disclosed by @NSEcho. HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages.

Details An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. A PoC was provided to Team RabbitMQ privately.

Impact Denial of Service

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement rate limiting, set resource quotas, validate input sizes, use timeouts.

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all

CVE-2023-44487 HIGH POC

7.5

CVE-2016-8610 HIGH

7.5

CVE-2026-28318 HIGH POC

7.5

CVE-2026-45498 MEDIUM POC

4.0

7.5

7.5

7.5

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Server 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5 SUSE Linux Enterprise Module for Server Applications 15 SP5 SUSE Linux Enterprise Server 15 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP5	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP6 SUSE Linux Enterprise Module for Server Applications 15 SP6 SUSE Linux Enterprise Server 15 SP6 SUSE Linux Enterprise Server for SAP Applications 15 SP6	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7	Fixed
openSUSE Leap 15.4	Fixed

CVE-2023-46118 vulnerability details – vuln.today

Back

openSUSE Leap 15.5	Fixed
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP4	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP5	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP6	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP6	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP6	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP6	Affected
SUSE Linux Enterprise Server 15 SP4	Affected
SUSE Linux Enterprise Server 15 SP4-LTSS	Affected
SUSE Linux Enterprise Server 15 SP5	Affected
SUSE Linux Enterprise Server 15 SP5-LTSS	Affected
SUSE Linux Enterprise Server 15 SP6	Affected
SUSE Linux Enterprise Server 15 SP6	Affected
SUSE Linux Enterprise Server 15 SP6	Affected
SUSE Linux Enterprise Server 15 SP6	Affected
SUSE Linux Enterprise Server 15 SP6-LTSS	Affected
SUSE Linux Enterprise Server 15 SP6-LTSS	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP6	Affected
SUSE Manager Proxy 4.3	Affected
SUSE Manager Proxy LTS 4.3	Affected
SUSE Manager Retail Branch Server 4.3	Affected
SUSE Manager Retail Branch Server LTS 4.3	Affected
SUSE Manager Server 4.3	Affected
SUSE Manager Server LTS 4.3	Affected
SUSE Enterprise Storage 7	Affected
SUSE Enterprise Storage 7.1	Affected
SUSE Linux Enterprise High Performance Computing 15 SP2	Affected
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP3	Affected
SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Affected
SUSE Linux Enterprise High Performance Computing 15 SP6	Affected
SUSE Linux Enterprise High Performance Computing 15 SP6	Affected
SUSE Linux Enterprise High Performance Computing 15 SP6	Affected
SUSE Linux Enterprise High Performance Computing 15 SP6	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP2	Affected
SUSE Linux Enterprise Module for Server Applications 15 SP3	Affected
SUSE Linux Enterprise Real Time 15 SP2	Affected
SUSE Linux Enterprise Real Time 15 SP3	Affected
SUSE Linux Enterprise Real Time 15 SP4	Affected
SUSE Linux Enterprise Server 15 SP2	Affected
SUSE Linux Enterprise Server 15 SP2-BCL	Affected
SUSE Linux Enterprise Server 15 SP2-LTSS	Affected
SUSE Linux Enterprise Server 15 SP3	Affected
SUSE Linux Enterprise Server 15 SP3-BCL	Affected
SUSE Linux Enterprise Server 15 SP3-LTSS	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP2	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP3	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP4	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP5	Affected
SUSE Manager Proxy 4.1	Affected
SUSE Manager Proxy 4.2	Affected
SUSE Manager Retail Branch Server 4.1	Affected
SUSE Manager Retail Branch Server 4.2	Affected
SUSE Manager Server 4.1	Affected
SUSE Manager Server 4.2	Affected
SUSE OpenStack Cloud 8	Affected
SUSE OpenStack Cloud 9	Affected
SUSE OpenStack Cloud Crowbar 8	Affected
SUSE OpenStack Cloud Crowbar 9	Affected
openSUSE Leap 15.3	Affected
openSUSE Leap 15.4	Affected
openSUSE Leap 15.5	Affected
openSUSE Leap 15.6	Affected
openSUSE Leap 15.6	Affected

Red Hat CVE-2023-46118

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

Summary

Details

Impact

AnalysisAI

Summary Responsibly disclosed by @NSEcho. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.

Technical ContextAI

Summary Responsibly disclosed by @NSEcho. HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages.

Details An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. A PoC was provided to Team RabbitMQ privately.

Impact Denial of Service

RemediationAI

Same weakness CWE-400 – Uncontrolled Resource Consumption

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code