Description
The Management plugin in RabbitMQ before 3.6.1 allows remote authenticated users with certain privileges to cause a denial of service (resource consumption) via the (1) lengths_age or (2) lengths_incr parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rabbitmq-server | 3.6.5-1 | — |
| Debian 13 | rabbitmq-server | 3.6.5-1 | — |
| Debian 12 | rabbitmq-server | 3.6.5-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | rabbitmq-server | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 8 | rabbitmq-server | 3.3.5-30.el7ost | RHSA-2017:0226 |
| Red Hat OpenStack 7 | rabbitmq-server | 3.3.5-31.el7ost | RHSA-2017:0530 |
| Red Hat OpenStack 6 | rabbitmq-server | 3.3.5-31.el7ost | RHSA-2017:0531 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 5 | rabbitmq-server | 3.1.5-7.el6ost | RHSA-2017:0533, RHSA-2017:0532 |
Advisories 5
- RHSA-2017:0533 Red Hat Security Advisory: rabbitmq-server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0532 Red Hat Security Advisory: rabbitmq-server security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0530 Red Hat Security Advisory: rabbitmq-server security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0531 Red Hat Security Advisory: rabbitmq-server security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2017:0226 Red Hat Security Advisory: rabbitmq-server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/rabbitmq_v3_6_1
- RHSA-2017:0532 vendor-advisory
- RHSA-2017:0530 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- RHSA-2017:0531 vendor-advisory
- RHSA-2017:0533 vendor-advisory
- https://github.com/rabbitmq/rabbitmq-management/issues/97
- 91508 vdb-entry
- RHSA-2017:0226 vendor-advisory