CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,476 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,476
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product rabbitmq:server. Show all products

57 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2026-66076Low 2.3RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67238High 7.1RabbitMQ: Atom-table exhaustion via reply-to queue name decoding
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-66070High 7.6RabbitMQ: CORS * reflects Origin with Allow-Credentials
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-66079High 8.2RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-66077High 7.3RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67224Low 2.1RabbitMQ: Admin path-traversal write via trace name
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67220Medium 6.0RabbitMQ: JMS topic exchange erl_scan atom exhaustion
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67404Critical 9.2RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-66069Low 2.3RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-66067Medium 6.0RabbitMQ: Stream protocol skips per vhost per user connection limits
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-66072Medium 6.0RabbitMQ: Atom table exhaustion via stream `chunk_selector`
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67240Low 2.3RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-66080Medium 5.9RabbitMQ: Super-stream partitions unbounded allocation
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67229Medium 6.9RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-66068Medium 5.6RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67235High 7.1RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67228Medium 6.9RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67219Medium 6.0RabbitMQ: Consistent-hash exchange unbounded weight
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-66075Low 2.3RabbitMQ: Monitoring-tag user can restart federation links
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67405Medium 5.3RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67232High 8.2RabbitMQ: Web-MQTT decompression bomb
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-66074Medium 6.0RabbitMQ: ReDoS via management API ?name= filter
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67218Low 2.1RabbitMQ: Super-stream HTTP creation skips configure-permission check
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67231Critical 9.1RabbitMQ: Trust-store whitelist by Issuer+Serial only
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67221Medium 5.9RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords
Assigned by GitHub_M
Sep 23, 2026
CVE-2026-67233Medium 6.0RabbitMQ: Monitoring-tag user can DELETE shovels
Assigned by GitHub_M
Sep 24, 2026
CVE-2026-67236High 8.2RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67222Medium 5.9RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67230Medium 6.3RabbitMQ: Web-STOMP unbounded pre-auth accumulation
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67225Medium 6.3RabbitMQ: Stream-protocol frame length never validated against frame_max
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67234Low 2.3RabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preference
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67237High 7.5RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-66073Medium 6.0RabbitMQ: Atom table exhaustion via management API node field
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-66078Low 2.1RabbitMQ: protected tag bypass via bulk-delete
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-66071Medium 6.0RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67241Medium 4.8RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67239High 7.6RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67223Medium 6.3RabbitMQ: LDAP DN injection via unescaped substitution
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67242Medium 6.3RabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float exp
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67409High 8.2RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67412Medium 6.0RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67415Medium 5.9RabbitMQ: Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-61837Medium 6.3RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67413Medium 6.0RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67411Medium 6.0RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67226Medium 6.9RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67407Medium 5.1RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67227Medium 5.9RabbitMQ: Atom exhaustion: to_atom on global-parameter :name
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67410High 8.2RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint
Assigned by GitHub_M
Sep 25, 2026
CVE-2026-67406Medium 4.6RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status
Assigned by GitHub_M
Sep 25, 2026
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.