p PatchFirst

CVE-2023-46118

CVE-2023-46118 · Denial of Service by publishing large messages over the HTTP API

This page contains facts from public vulnerability sources. Check the original advisory before updating.

RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.

CVSS 4.9 · Medium · EPSS 1.3% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • rabbitmq

    Versions
    • < 3.12.7: Affected
    • < 3.11.24: Affected

    No fix published

  • rabbitmq-server Debian:12

    Versions
    • 3.10.8-1.1
    Affected ranges
    • ECOSYSTEM: < 3.10.8-1.1+deb12u1

    Update to 3.10.8-1.1+deb12u1

  • rabbitmq-server Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.10.8-3

    Update to 3.10.8-3

  • rabbitmq-server Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.10.8-3

    Update to 3.10.8-3

  • rabbitmq-server Ubuntu:Pro:16.04:LTS

    Versions
    • 3.5.4-1
    • 3.5.4-3
    • 3.5.4-3.1
    • 3.5.7-1
    • 3.5.7-1ubuntu0.16.04.1
    • 3.5.7-1ubuntu0.16.04.2
    • 3.5.7-1ubuntu0.16.04.4
    • 3.5.7-1ubuntu0.16.04.4+esm1
    • 3.5.7-1ubuntu0.16.04.4+esm2
    • 3.5.7-1ubuntu0.16.04.4+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rabbitmq-server Ubuntu:Pro:18.04:LTS

    Versions
    • 3.6.10-1
    • 3.6.10-1ubuntu0.1
    • 3.6.10-1ubuntu0.3
    • 3.6.10-1ubuntu0.4
    • 3.6.10-1ubuntu0.5
    • 3.6.10-1ubuntu0.5+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • rabbitmq-server Ubuntu:20.04:LTS

    Versions
    • 3.7.8-4ubuntu2
    • 3.7.18-1
    • 3.8.2-0ubuntu1
    • 3.8.2-0ubuntu1.1
    • 3.8.2-0ubuntu1.2
    • 3.8.2-0ubuntu1.3
    • 3.8.2-0ubuntu1.4
    Affected ranges
    • ECOSYSTEM: < 3.8.2-0ubuntu1.5

    Update to 3.8.2-0ubuntu1.5

  • rabbitmq-server Ubuntu:22.04:LTS

    Versions
    • 3.8.9-3ubuntu1
    • 3.9.8-1
    • 3.9.8-2
    • 3.9.8-3
    • 3.9.8-5
    • 3.9.8-6
    • 3.9.13-1
    • 3.9.13-1ubuntu0.22.04.1
    Affected ranges
    • ECOSYSTEM: < 3.9.13-1ubuntu0.22.04.2

    Update to 3.9.13-1ubuntu0.22.04.2

  • rabbitmq-server Ubuntu:24.04:LTS

    Versions
    • 3.12.1-1
    Affected ranges
    • ECOSYSTEM: < 3.12.1-1ubuntu1

    Update to 3.12.1-1ubuntu1

Original sources

Check your server →