RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.
Fix
Patch, vendor advisory and mitigation references on NVD 6
- https://github.com/rabbitmq/rabbitmq-server/commit/3976d148901bdfa82e1cd60b7a4534e073266ba5 Patch
- https://github.com/rabbitmq/rabbitmq-server/commit/b8fc2ef7c50a2797d15e1ea7cf34f290032303bb Patch
- https://github.com/rabbitmq/rabbitmq-server/pull/15712 Issue Tracking, Patch
- https://github.com/rabbitmq/rabbitmq-server/pull/15714 Issue Tracking, Patch
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cmq-vp28-xqrj Exploit, Vendor Advisory
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cmq-vp28-xqrj Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.1 · broadcomNVD modified 2026-10-25 15:10
Affected (CPE criteria) 1
cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
References 7
- https://github.com/rabbitmq/rabbitmq-server/commit/3976d148901bdfa82e1cd60b7a4534e073266ba5 Patch
- https://github.com/rabbitmq/rabbitmq-server/commit/b8fc2ef7c50a2797d15e1ea7cf34f290032303bb Patch
- https://github.com/rabbitmq/rabbitmq-server/pull/15712 Issue Tracking, Patch
- https://github.com/rabbitmq/rabbitmq-server/pull/15714 Issue Tracking, Patch
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.5 Release Notes
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cmq-vp28-xqrj Exploit, Vendor Advisory
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cmq-vp28-xqrj Exploit, Vendor Advisory