GitHub Advisoryadvisory · Hex

GHSA-w6cq-9cf4-gqpg RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API

MEDIUM Published 2026-06-30 Modified 2026-06-30 Official page ↗
Aliases
CVE-2023-46118
Ecosystem
Hex
Packages
rabbit_common
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2026-06-30

Affected packages

• Hex rabbit_common: >= 3.12.0, < 3.12.7 → fixed in 3.12.7 • Hex rabbit_common: >= 3.11.0, < 3.11.24 → fixed in 3.11.24

Description

Summary Responsibly disclosed by @NSEcho. HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages. Details An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. A PoC was provided to Team RabbitMQ privately. Impact Denial of Service

Related

Alias · CVE (1)

  • CVE-2023-46118 RabbitMQ is a multi-protocol messaging and streaming broker. vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References