Description
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rabbitmq | rabbitmq-server | < 3.12.7, < 3.11.24 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rabbitmq-server | 3.10.8-3 | — |
| Debian 13 | rabbitmq-server | 3.10.8-3 | — |
| Debian 12 | rabbitmq-server | 3.10.8-1.1+deb12u1 | DSA-5571-1 |
| Debian 11 | rabbitmq-server | 3.8.9-3+deb11u1 | DSA-5571-1 |
| Debian 10 | rabbitmq-server | 3.8.2-1+deb10u2 | DLA-3687-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | rabbitmq-server | 3.12.1-1ubuntu1 | — |
| Ubuntu 22.04 LTS | rabbitmq-server | 3.9.13-1ubuntu0.22.04.2 | USN-6501-1 |
| Ubuntu 20.04 LTS | rabbitmq-server | 3.8.2-0ubuntu1.5 | USN-6501-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | rabbitmq-server | No fix yet | — |
| Ubuntu Pro 16.04 LTS | rabbitmq-server | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 17 | rabbitmq-server | 3.9.10-3.el9ost | RHSA-2024:0217 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | elixir115 | 1.15.7-150300.7.5.1 | SUSE-FU-2024:2078-1 |
| SLES 15 SP6 | erlang26 | 26.2.1-150300.7.5.1 | SUSE-FU-2024:2078-1 |
| SLES 15 SP6 | rabbitmq-server313 | 3.13.1-150600.13.5.3 | SUSE-FU-2024:2078-1 |
| SLES 15 SP5 | rabbitmq-server | 3.8.11-150300.3.14.1 | SUSE-SU-2023:4939-1 |
| SLES 15 SP4 | rabbitmq-server | 3.8.11-150300.3.14.1 | SUSE-SU-2023:4939-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | elixir115 | 1.15.7-150300.7.5.1 | SUSE-FU-2024:2078-1 |
| openSUSE Leap 15.6 | erlang26 | 26.2.1-150300.7.5.1 | SUSE-FU-2024:2078-1 |
| openSUSE Leap 15.6 | rabbitmq-server313 | 3.13.1-150600.13.5.3 | SUSE-FU-2024:2078-1 |
| openSUSE Leap 15.5 | rabbitmq-server | 3.8.11-150300.3.14.1 | SUSE-SU-2023:4939-1 |
| openSUSE Leap 15.4 | rabbitmq-server | 3.8.11-150300.3.14.1 | SUSE-SU-2023:4939-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | rabbitmq-server | 3.13.0-1 | — |
| Azure Linux 2 (CBL-Mariner) | rabbitmq-server | 3.11.24-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hex | rabbit_common | >= 3.12.0, < 3.12.7 | 3.12.7 | GHSA-w6cq-9cf4-gqpg |
| Hex | rabbit_common | >= 3.11.0, < 3.11.24 | 3.11.24 | GHSA-w6cq-9cf4-gqpg |
Advisories 7
- RHSA-2024:0217 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (rabbitmq-server) security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- WID-SEC-2023-2761 RabbitMQ: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jun 30, 2026
- USN-6501-1 rabbitmq-server vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5571-1 rabbitmq-server - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3687-1 rabbitmq-server - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-FU-2024:2078-1 Feature update for rabbitmq-server313, erlang26, elixir115 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4939-1 Security update for rabbitmq-server SUSE / openSUSE Security Updates · Feb 4, 2026