R
Vendor security profile
rabbitmq
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs76
Critical5
CISA KEV0
Public exploit26
Patch rate%18
Avg. CVSS6.3
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
7
65
4
CVE KEV
CVE severity distribution
76toplam CVE
Critical5 (7%)
High25 (33%)
Medium36 (47%)
Low10 (13%)
Patch and exploitation view
%18
Verified patch
%0
CISA KEV
%34
Public exploit
14Patch available
0Partial
0Workaround
0Vendor: no patch
62Unknown
Latest vulnerabilities
6.3
CVE-2026-107386
amqp091-go: Pre-negotiation frame limit is not enforced to 4KB
R
Patch status unknownEPSS %0
5.7
CVE-2026-106123
RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
R
Patch verifiedEPSS %0
6.0
CVE-2026-106122
RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers
R
Patch verifiedEPSS %0
4.9
CVE-2026-106121
RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
R
Patch verifiedEPSS %1
2.3
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime tags
R
Patch status unknownEPSS %0
7.1
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial routing work
R
Patch status unknownEPSS %0
4.5
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling
R
Patch verifiedEPSS %0
7.1
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service
R
Patch verifiedEPSS %0
4.6
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_status
R
Patch status unknownEPSS %0
8.2
CVE-2026-67410
RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint
R
Patch verifiedEPSS %0