Skip to content
OpenAdvisories
Medium RHSA-2026:82703 3 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Oct 17, 2026 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 rabbitmq-server4.3 0:4.3.6-1.1.hum1

Vulnerabilities 3

  • Medium 6.0
    CVE-2026-67414

    RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation

    RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the num…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu
  • Medium 5.3
    CVE-2026-67416

    RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation

    RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, the optimized AMQP 1.0 server_mode parser in deps/amqp10_common/src/amqp10_binary_parser.erl matches the textual prefixes of symbolic data, sequence, and value b…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu
  • Medium 5.3
    CVE-2026-67418

    RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers

    RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmq_mqtt/src/rabbit_mqtt_packet.erl accepts Request-Problem-Information on PUBLISH packets even though the property is v…

    rabbitmq rabbitmq-server rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-67418
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-67416
  • report
    https://access.redhat.com/security/cve/CVE-2026-67414
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82703.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552665
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67414
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67414
  • article
    https://github.com/rabbitmq/rabbitmq-server/commit/3f0f67dfb7c4390e3cbfa25ab3ee19dcb0845bd4
  • article
    https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.4
  • article
    https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6mq-4qpx-v7mh
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552574
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67416
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67416
  • article
    https://github.com/rabbitmq/rabbitmq-server/commit/c9b4b10c2dbf0f1c89f10b482ac8b45f84dc5954
  • article
    https://github.com/rabbitmq/rabbitmq-server/commit/d5186e66e056960f58e2d0fbee2fcc66e1ed6fb9
  • article
    https://github.com/rabbitmq/rabbitmq-server/pull/17017
  • article
    https://github.com/rabbitmq/rabbitmq-server/pull/17287
  • article
    https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-p35w-6mx2-q4pc
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2552635
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-67418
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-67418
  • article
    https://github.com/rabbitmq/rabbitmq-server/commit/4639a4318c72a0660e4bc014767fad70ce288fbc
  • article
    https://github.com/rabbitmq/rabbitmq-server/commit/908f944a1d581d10774f8d6d0dcf2a1a713779fb
  • article
    https://github.com/rabbitmq/rabbitmq-server/pull/17035
  • article
    https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5
  • article
    https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-jv99-v328-mvmm