PatchFirst · Latest vulnerabilities
Vulnerability published for rabbitmq-server in the last 30 days: 1. Listed in the KEV catalogue: 0.
Vulnerabilities: 3
This update for rabbitmq-server fixes the following issue: - CVE-2026-57215: direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom (bsc#1271338).
This update for rabbitmq-server fixes the following issues: - CVE-2026-44839: XSS in management UI due to unsanitized vhost names (bsc#1266465). - CVE-2026-57212: The rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths (bsc#1271318). - CVE-2026-57213: stored XSS in RabbitMQ federation management plugin via unsanitized consumer_tag rendering (bsc#1271336). - CVE-2026-57214: stored XSS in RabbitMQ management UI (bsc#1271337). - CVE-2026-57215: direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom (bsc#1271338). - CVE-2026-57216: str
This update for rabbitmq-server fixes the following issues: Changes in rabbitmq-server: Update to 4.1.5: * Highlights - Khepri, an alternative schema data store developed to replace Mnesia, has matured and is now fully supported (it previously was an experimental feature) - AMQP 1.0 is now a core protocol that is always enabled. Its plugin is now a no-op that only exists to simplify upgrades. - The AMQP 1.0 implementation is now significantly more efficient: its peak throughput is more than double than that of 3.13.x on some workloads - Efficient sub-linear quorum queue recovery on node startup using checkpoints - Quorum
Check your installed stack and versions against the current vulnerability feeds.