Product by Ubuntu
Rabbitmq-server
13 known vulnerabilities in Rabbitmq-server (Ubuntu), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-67237 | RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint | 9.3 | |
| High | CVE-2026-67409 | Rabbitmq-server: Unchecked Return Value | 6.5 | |
| High | CVE-2026-66070 | RabbitMQ: CORS * reflects Origin with Allow-Credentials | 8.8 | |
| High | CVE-2026-67232 | RabbitMQ: Web-MQTT decompression bomb | 7.5 | |
| Critical | CVE-2026-67231 | RabbitMQ: Trust-store whitelist by Issuer+Serial only | 9.1 | |
| Critical | CVE-2026-67404 | RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch | 7.4 | |
| High | CVE-2026-66079 | RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS | 7.5 | |
| High | CVE-2026-67238 | RabbitMQ: Atom-table exhaustion via reply-to queue name decoding | 6.5 | |
| High | CVE-2026-67236 | RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login | 6.5 | |
| High | CVE-2026-59248 | Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS | — | |
| High | CVE-2026-67235 | RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size | 6.5 | |
| High | CVE-2026-67239 | RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI | 5.4 | |
| High | CVE-2026-66077 | RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI | 6.1 |