Skip to main content

RabbitMQ CVE-2026-57212

| EUVDEUVD-2026-43015 HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-07-10 GitHub_M
Denial Of Service Rabbitmq Server Suse Red Hat
7.1
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.1 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-reachable management API with low-privilege auth (PR:L), no user interaction, low complexity; impact is availability-only (A:H) via resource exhaustion, no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.7 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Patch available
Jul 10, 2026 - 22:02 EUVD
Analysis Generated
Jul 10, 2026 - 21:18 vuln.today

DescriptionCVE.org

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

AnalysisAI

Uncontrolled resource consumption in the RabbitMQ Management plugin's HTTP API lets an authenticated client crash or degrade the broker by submitting oversized-but-valid JSON bodies. The flaw lives in read_complete_body, which validates accumulated body size before the final chunk but never checks the final combined size, so the with_decode and direct_request code paths buffer and decode payloads that exceed intended limits. Affected releases are all versions prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

RabbitMQ is a widely used AMQP/streaming message broker (Erlang/OTP). The vulnerable component is the optional rabbitmq_management plugin, which exposes an HTTP REST/management API (default TCP 15672). Requests can be chunked; read_complete_body accumulates chunks and is supposed to enforce a maximum body size. The defect is an off-by-boundary size check: it compares the accumulated size before appending the final chunk but omits a check on the total combined size once the last chunk is added, so an oversized JSON payload passes validation and is fully buffered and JSON-decoded. This maps to CWE-770 (Allocation of Resources Without Limits or Throttling): unbounded memory/CPU is consumed parsing the payload, exhausting broker resources. Per the CPE (cpe:2.3:a:rabbitmq:rabbitmq-server), the exposure exists in rabbitmq-server itself when the management API is enabled.

RemediationAI

Vendor-released patch: upgrade to RabbitMQ 3.13.14, 4.0.19, 4.1.10, or 4.2.5 (or later) on the matching branch - this restores the missing final combined-size check on read_complete_body per the advisory GHSA-5cmq-vp28-xqrj and fixes referenced in PRs #15712/#15714 and commits 3976d14/b8fc2ef; release artifacts are at https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.5. Where immediate patching is not possible, reduce exposure by restricting access to the management HTTP API (default port 15672): bind it to localhost or a management VLAN, place it behind a reverse proxy or firewall that enforces a small max request-body size to cap oversized JSON before it reaches the broker, and never expose 15672 to the internet - trade-off is that legitimate management clients must route through the proxy/allowed network. Additionally, tighten management-plugin user permissions and rotate/limit low-privilege management credentials, since exploitation requires authenticated access; if the management plugin is not needed, disabling it (rabbitmq-plugins disable rabbitmq_management) removes the attack surface entirely at the cost of losing the web UI and REST API.

More in Rabbitmq Server

View all
CVE-2026-57219 HIGH POC
8.7 Jul 10

Sensitive credential disclosure in RabbitMQ affects installations running the management plugin with OAuth 2 configured

CVE-2019-11287 HIGH POC
7.5 Nov 23

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x ver
CVE-2016-9877 CRITICAL
9.8 Dec 29

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.
CVE-2025-50200 MEDIUM POC
5.5 Jun 19

RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in
CVE-2017-4966 HIGH
7.8 Jun 13

An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions p
CVE-2021-22117 HIGH
7.8 May 18

RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing

CVE-2026-57220 HIGH
7.5 Jul 10

Memory-exhaustion denial of service in RabbitMQ server prior to 4.2.6 allows an unauthenticated remote client to crash o
CVE-2026-57214 HIGH
7.1 Jul 10

Stored cross-site scripting in the RabbitMQ management UI (versions prior to 4.2.5) lets a user holding queue/exchange d
CVE-2026-57217 HIGH
7.0 Jul 10

Authorization bypass in RabbitMQ topic permissions lets an authenticated user with restricted topic rights publish to or
CVE-2026-57215 HIGH
7.0 Jul 10

Improper authorization in RabbitMQ broker (versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6) allows an authenticated
CVE-2026-57216 CRITICAL
10.0 Jul 10

Authentication bypass in RabbitMQ (broker versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6) lets a loopback-restrict
CVE-2026-57211 CRITICAL
10.0 Jul 10

Server-side request forgery and NTLM credential exposure in the RabbitMQ management plugin (versions 4.1.0 to before 4.1

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-57212 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy