An integer overflow vulnerability in the MPack Node API in MPack 1.1.1 on 32-bit platforms can cause heap-buffer-overflow, memory corruption, and denial of service when parsing crafted MessagePack array32 or map32 objects with large element counts.
A vulnerability in rpm allows an attacker to supply a crafted manifest file that triggers arbitrary code execution when processed by commands like `rpm -q -p`. This occurs due to unexpected macro expansion of manifest entries, enabling embedded shell commands to run with the privileges of the rpm process. Exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected account.
A command injection vulnerability exists in rpm when installing or rebuilding source RPMs with source or spec file basenames containing a %() macro construct. This flaw allows execution of arbitrary shell commands via popen() as the invoking user, typically non-root, by processing a crafted .src.rpm file.
A vulnerability in GIMP's GIMPressionist plug-in allows an out-of-bounds write when processing specially crafted preset files due to improper validation of vector indices. This flaw can lead to memory corruption, potentially causing application crashes or arbitrary code execution if a user opens a malicious preset file.
Nanomsg versions from 0.5-beta through all 1.x versions before 1.2.3 contain a remotely exploitable buffer overflow vulnerability in the WebSocket transport. This issue arises from an unchecked copy operation of the Sec-WebSocket-Version header using snprintf. The vulnerability allows remote attackers to potentially cause a buffer overflow, which could lead to denial of service or other impacts.
RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 contain a vulnerability in the consistent-hash exchange plugin where the add_binding/3 function parses the routing key as an integer weight without an upper bound. This allows a user with write permission on a consistent-hash exchange and read permission on a queue to create a binding with an arbitrarily large weight, causing excessive memory allocation (~800 MB for weight 100000000) on all cluster nodes. The allocated list is persisted cluster-wide and survives restarts, potentially leading to resource exhaustion. The issue is fixed in the specified versions.
CVE-2026-67220 is a vulnerability in RabbitMQ server affecting versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. It involves the handling of bindings on x-jms-topic exchanges where the server processes selector strings without length limits or proper validation, leading to atom table exhaustion. An authenticated low-privilege AMQP user confined to one virtual host can cause a denial of service by crashing the broker node with fewer than 100 bind calls. The issue requires the rabbitmq_jms_topic_exchange plugin to be enabled and specific permissions on exchanges and queues. Fixed versions have been released to address this issue.
RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 contain a vulnerability where the AMQP 1.0 shovel stores the raw connection URI including the password, exposing sensitive credentials. This stored URI is accessible via the GET /api/shovels endpoint and the rabbitmqctl shovel_status command. The issue requires the Shovel plugin to be in use with AMQP 1.0 shovels configured using URI-embedded credentials, and reading the exposed status requires the monitoring tag. The vulnerability is fixed in the specified versions.
CVE-2026-67224 is a vulnerability in RabbitMQ server's tracing plugin that allows an administrator user to write arbitrary .log files to any filesystem path writable by the RabbitMQ OS user. This occurs because the trace consumer does not apply safe relative path or traversal checks on the write side, enabling potential arbitrary file overwrite or creation outside the intended trace directory. The vulnerability requires the tracing plugin to be enabled and administrator privileges. It is fixed in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
CVE-2026-67228 is a denial of service vulnerability in RabbitMQ server prior to versions 4.2.7 and 4.3.1. The issue arises from the runtime-parameters lookup path converting attacker-supplied URL components into new Erlang atoms without checking if they already exist. Because atoms are not garbage collected and the atom table is bounded, an attacker with policymaker privileges can exhaust the atom table by issuing roughly one million distinct requests, causing the RabbitMQ node to crash. This vulnerability is fixed in versions 4.2.7 and 4.3.1.
CVE-2026-67229 affects RabbitMQ server versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. An administrator importing a crafted definitions file with a vhost entry containing approximately one million unique metadata keys can exhaust the Erlang atom table, causing the node to crash. This vulnerability arises from the use of an unsafe function that converts binary keys to atoms during vhost metadata processing. The issue requires administrator privileges to exploit and is fixed in the specified versions.
RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 contain a vulnerability in the trust-store plugin that allows TLS client-authentication bypass. The plugin's verification function incorrectly trusts certificates based solely on issuer and serial number, enabling attackers who know these values to connect with forged self-signed certificates. This issue requires the trust-store plugin to be enabled and used as the TLS verify function. The vulnerability is fixed in the specified versions.
CVE-2026-67232 is a vulnerability in RabbitMQ server's Web-MQTT plugin where the WebSocket handler enables compression without limiting decompression size. This allows an unauthenticated attacker to send a specially crafted compressed WebSocket frame that inflates to a very large size in memory, causing a denial of service by crashing the RabbitMQ node. The issue affects versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. The vulnerability requires the rabbitmq_web_mqtt plugin to be enabled and network access to ports 15675 or 15676. A fix is available in the stated versions.
CVE-2026-67235 is a vulnerability in RabbitMQ server versions prior to 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15 where the content-header BodySize field was not validated against max_message_size until assembly completion. This allows an authenticated AMQP 0-9-1 client with publish permission to cause unbounded memory accumulation by declaring an extremely large body size and streaming fragments, potentially leading to memory exhaustion and cluster-wide degradation. The issue is mitigated partially by a reactive memory alarm but is fixed in the stated versions.
CVE-2026-67240 affects RabbitMQ server versions prior to 4.2.7 and 4.3.1. It involves a CPU amplification issue caused by crafted LIKE filters in AMQP 1.0 stream queues. An authenticated consumer with read and write permissions can cause significant CPU usage per message by exploiting overlapping lazy quantifiers in pattern matching. This vulnerability is fixed in versions 4.2.7 and 4.3.1.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker in a man-in-the-middle position can forge the JWKS response, which leads the broker to accept arbitrary JWTs. Preconditions include The OAuth2 plugin must be in use with no cacertfile configured and the OS CA bundle empty or unreadable (for example, in a minimal container), and the attacker must hold a network man-in-the-middle position.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 contain a vulnerability where the Web-MQTT and Web-STOMP handlers do not validate the Origin header on WebSocket upgrades. When configured with ssl_cert_login=true or use_http_auth=true, this can allow an attacker's JavaScript running in a victim's browser to authenticate as the victim. The issue does not affect default configurations and is fixed in the stated versions.
RabbitMQ versions prior to 4.2.7 and 4.3.1 contain a vulnerability in the stream open handler that allows authenticated tenants to bypass operator-configured per-user and per-vhost connection limits by connecting via port 5552 instead of the standard AMQP port 5672. This occurs because the stream open handler only checks vhost access but omits node/vhost/user connection-limit checks enforced for AMQP connections. The issue is fixed in versions 4.2.7 and 4.3.1.
RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 contain a vulnerability where autodelete shovel completion with DEBUG logging enabled causes plaintext AMQP URIs, including embedded credentials, to be written to broker log files. This occurs because the shovel state map is fully formatted without redacting sensitive URI information. The issue requires the Shovel plugin enabled, DEBUG log level, autodelete shovel configuration, and attacker log read access.
CVE-2026-66069 affects RabbitMQ server versions prior to 4.1.13, 4.2.7, and 4.3.0. It allows a user with a monitoring tag to reset per-node authentication-attempt counters via a DELETE request to /api/auth/attempts/:node, erasing evidence of brute-force attempts. This operation is inconsistent with the analogous reset operation which requires administrator privileges. The impact is cosmetic, affecting only counters without erasing logs. The vulnerability requires the Management plugin to be enabled and is fixed in the specified versions.