OESA-2026-4029

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4029

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-4029.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2026-4029

Upstream

CVE (2)

Published

2026-09-25T01:27:28Z

Modified

2026-09-25T01:45:04Z

Severity

7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H CVSS Calculator

Summary

rabbitmq-server security update

Details

RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker.

Security Fix(es):

RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.(CVE-2023-46118)

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.(CVE-2026-57212)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:20.03-LTS-SP4 / rabbitmq-server

Package

Name: rabbitmq-server
Purl: pkg:rpm/openEuler/rabbitmq-server&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.7.23-3.oe2003sp4

Ecosystem specific

{
    "aarch64": [
        "rabbitmq-server-3.7.23-3.oe2003sp4.aarch64.rpm"
    ],
    "src": [
        "rabbitmq-server-3.7.23-3.oe2003sp4.src.rpm"
    ],
    "x86_64": [
        "rabbitmq-server-3.7.23-3.oe2003sp4.x86_64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-4029.json"