Security Advisories · rabbitmq/rabbitmq-server · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

Atom exhaustion: to_atom on runtime-parameter component
GHSA-73qp-fwh4-2q5g published Jul 9, 2026 by ansd

Moderate
Atom exhaustion: to_atom on global-parameter :name
GHSA-q7x8-97rh-cr24 published Jul 23, 2026 by michaelklishin

Moderate
Admin-only atom exhaustion: PUT /api/users tags list
GHSA-34c7-r8w9-5wv8 published Jul 23, 2026 by michaelklishin

Moderate
Stream-protocol frame length never validated against frame_max
GHSA-c8c4-gvv4-8j3q published Jul 9, 2026 by ansd

Moderate
CSWSH on Web-STOMP / Web-MQTT (no Origin validation)
GHSA-9c4f-rxxm-88q3 published Jul 9, 2026 by ansd

Moderate
Admin path-traversal write via trace name
GHSA-h7cq-qrr8-7vgc published Jul 9, 2026 by ansd

Low
LDAP DN injection via unescaped substitution
GHSA-9x7r-g78c-5835 published Jul 22, 2026 by michaelklishin

Moderate
OAuth2 silent verify_none fallback for JWKS fetch
GHSA-37wx-r6q9-6fhj published Jul 9, 2026 by ansd

Critical
list_to_atom on auth_mechanism URI tokens in amqp_client
GHSA-85jr-6rr2-j73r published Jul 9, 2026 by ansd

Moderate
AMQP 1.0 shovel status exposes plaintext URI passwords
GHSA-x5h5-588r-cv55 published Jul 9, 2026 by ansd

Moderate