rabbitmq-server vulnerabilities
CVEs whose affected-version data names the rabbitmq-server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
35 CVEsRSS
CVE-2026-67404Critical· 9.2RabbitMQ is a messaging and streaming broker
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker in a man-in-the-m…
CVE-2026-67238High· 7.1RabbitMQ is a messaging and streaming broker
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reac…
CVE-2026-66079High· 8.2RabbitMQ is a messaging and streaming broker
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 r…
CVE-2026-66076Low· 2.3PoC⚖ disputedRabbitMQ is a messaging and streaming broker
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. Th…
CVE-2026-66070High· 7.6RabbitMQ is a messaging and streaming broker
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoe…