BIT-rabbitmq-2026-67225

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/rabbitmq/BIT-rabbitmq-2026-67225.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-rabbitmq-2026-67225
Aliases
Published
2026-10-01T09:33:15Z
Modified
2026-10-01T10:11:16Z
Summary
RabbitMQ: Stream-protocol frame length never validated against frame_max
Details

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tune handshake but did not compare it with an inbound frame's declared length before buffering the frame. With the stream plugin enabled, a remote client could therefore cause excessive memory pressure and denial of service by declaring an oversized frame. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Database specific 
{
    "cpes":  [
        "cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:*"
    ],
    "severity":  "Medium"
}
References

Affected packages

Bitnami / rabbitmq

Package

Name
rabbitmq
Purl
pkg:bitnami/rabbitmq

Severity

  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
3.13.0
Fixed
3.13.15
Introduced
4.0.0
Fixed
4.0.20
Introduced
4.1.0
Fixed
4.1.11
Introduced
4.2.0
Fixed
4.2.6

Database specific

source 
"https://github.com/bitnami/vulndb/tree/main/data/rabbitmq/BIT-rabbitmq-2026-67225.json"