PT-2026-57297 · Rabbitmq · Rabbitmq-Server

Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-57212

NVD

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq management HTTP API accepts oversized valid JSON bodies on with decode and direct request paths because read complete body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2026-57212

Produtos afetados

Rabbitmq-Server

Referências · 7

• https://github.com/rabbitmq/rabbitmq-server/commit/b8fc2ef7c50a2797d15e1ea7cf34f290032303bb · Nota
• https://github.com/rabbitmq/rabbitmq-server/pull/15714 · Nota
• https://github.com/rabbitmq/rabbitmq-server/commit/3976d148901bdfa82e1cd60b7a4534e073266ba5 · Nota
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cmq-vp28-xqrj · Nota
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.5 · Nota
• https://github.com/rabbitmq/rabbitmq-server/pull/15712 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-57212 · Nota de Segurança