Skip to content
OpenAdvisories
High USN-8869-1 1 CVE

rabbitmq-server vulnerability

Published Oct 6, 2026 · Updated Oct 6, 2026

Ecosystem: Ubuntu

Summary

It was discovered that RabbitMQ Server incorrectly handled certain HTTP/2
headers. An attacker could possibly use this issue to cause a denial of
service via memory exhaustion.

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS rabbitmq-server 3.9.27-0ubuntu0.5
Ubuntu · 24.04 LTS 24.04:LTS rabbitmq-server 3.12.1-1ubuntu1.6
Ubuntu · 26.04 LTS 26.04:LTS rabbitmq-server 4.0.5-10ubuntu5.1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS rabbitmq-server 3.8.3-0ubuntu0.3+esm1

Vulnerabilities 1

  • High 8.7
    CVE-2026-59248 Public exploit

    Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

    Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder …

    ninenines cowlib rabbitmq-server rabbitmq-server Debian Ubuntu Azure Linux Hex

References

  • report
    https://ubuntu.com/security/CVE-2026-59248