Vulnerabilidades em rabbitmq
100 resultadosAnálise Vexday
RabbitMQ acumula 21 vulnerabilidades conhecidas na base Vexday, com destaque preocupante: 13 foram publicadas nos últimos 90 dias, sinalizando descobertas recentes e potencial de exploração. Nenhuma está em ataque ativo documentado (KEV), mas a ausência de críticas CVSS não reduz o risco, visto que a fraqueza dominante (CWE-863 — verificação inadequada de autorização) afeta componentes de acesso e controle. O ritmo acelerado de divulgações recentes recomenda priorização de patches e auditoria de permissões nas implementações.
CVE-2026-77412HIGHRabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP ClientEPSS 0.5%CVE-2026-77409HIGHRabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel BlockingEPSS 0.5%CVE-2026-77411CRITICALRabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstrEPSS 0.5%CVE-2026-77408CRITICALRabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer OverflowEPSS 0.5%CVE-2026-63335MEDIUMRabbitMQ Java client malformed body frame triggers raw command assembler exceptionEPSS 0.5%CVE-2026-57216MEDIUMRabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checksEPSS 0.5%CVE-2026-107386MEDIUMamqp091-go: Pre-negotiation frame limit is not enforced to 4KBEPSS 0.5%CVE-2026-106122MEDIUMRabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumersEPSS 0.5%CVE-2026-67413MEDIUMRabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular ExpressionEPSS 0.5%CVE-2026-61634NONERabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_maxEPSS 0.5%CVE-2026-66072MEDIUMRabbitMQ: Atom table exhaustion via stream `chunk_selector`EPSS 0.5%CVE-2026-66073MEDIUMRabbitMQ: Atom table exhaustion via management API node fieldEPSS 0.5%CVE-2026-67237HIGHRabbitMQ: Reflected XSS via the OAuth bootstrap JS endpointEPSS 0.5%CVE-2026-67408HIGHRabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of ServiceEPSS 0.4%CVE-2026-66067MEDIUMRabbitMQ: Stream protocol skips per vhost per user connection limitsEPSS 0.4%CVE-2026-57212HIGHRabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_sizeEPSS 0.4%CVE-2026-66078LOWRabbitMQ: protected tag bypass via bulk-deleteEPSS 0.4%CVE-2026-67234LOWRabbitMQ: Non-RFC-conformant cookie name when clearing the auth-mechanism preferenceEPSS 0.4%CVE-2026-67241MEDIUMRabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission checkEPSS 0.4%CVE-2026-67409HIGHRabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoSEPSS 0.4%