UbuntuUpdates.org

Package "rabbitmq-server"

Name: rabbitmq-server

Description:

AMQP server written in Erlang
Latest version: 3.12.1-1ubuntu1.7
Release: noble (24.04)
Level: updates
Repository: main
Homepage: https://www.rabbitmq.com/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "rabbitmq-server"

All arch deb package
APT INSTALL

Other versions of "rabbitmq-server" in Noble

Repository Area Version
base main 3.12.1-1ubuntu1
security main 3.12.1-1ubuntu1.7

Changelog

Version: 3.12.1-1ubuntu1.7 2026-10-21 09:07:48 UTC

rabbitmq-server (3.12.1-1ubuntu1.7) noble-security; urgency=medium

  * SECURITY UPDATE: CORS misconfiguration
    - debian/patches/CVE-2026-66070.patch: fix CORS wildcard origin
      reflecting credentials in rabbit_mgmt_cors.erl
    - CVE-2026-66070
  * SECURITY UPDATE: Stored XSS
    - debian/patches/CVE-2026-66077.patch: fix stored XSS via TLS
      peer-certificate DN in management UI connection.ejs
    - CVE-2026-66077
  * SECURITY UPDATE: Pre-auth denial of service
    - debian/patches/CVE-2026-66079.patch: fix pre-auth AMQP 1.0 array32
      zero-width element DoS in amqp10_binary_parser.erl
    - CVE-2026-66079
  * SECURITY UPDATE: TLS authentication bypass
    - debian/patches/CVE-2026-67231_1.patch: fix TLS client-auth bypass
      in trust-store plugin using SHA-256 cert fingerprint
    - CVE-2026-67231
  * SECURITY UPDATE: Pre-auth denial of service
    - debian/patches/CVE-2026-67232.patch: set Cowboy max_frame_size for
      Web MQTT and Web STOMP to prevent zlib bomb DoS
    - CVE-2026-67232
  * SECURITY UPDATE: Unbounded memory allocation
    - debian/patches/CVE-2026-67235.patch: validate content-header body size
      against max_message_size in rabbit_command_assembler.erl
    - CVE-2026-67235
  * SECURITY UPDATE: Cleartext credential storage
    - debian/patches/CVE-2026-67236.patch: remove insecure auth cookie
      storing base64-encoded credentials without HttpOnly/Secure flags
    - CVE-2026-67236
  * SECURITY UPDATE: Reflected XSS
    - debian/patches/CVE-2026-67237.patch: fix reflected XSS via OAuth
      bootstrap JS by escaping bearer token with JSON encoding
    - CVE-2026-67237
  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2026-67238.patch: use binary_to_existing_atom
      instead of binary_to_atom in pid_recomposition.erl to prevent
      atom table exhaustion DoS
    - CVE-2026-67238
  * SECURITY UPDATE: Stored XSS
    - debian/patches/CVE-2026-67239_1.patch: fix stored XSS via TLS
      peer-certificate DN in stream management UI streamConnection.ejs
    - debian/patches/CVE-2026-67239_2.patch: apply fmt_string to more
      rendered values in streamConnection.ejs
    - CVE-2026-67239
  * SECURITY UPDATE: Authentication denial of service
    - debian/patches/CVE-2026-67409.patch: validate HTTP response status
      code when fetching JWKS keys to prevent auth DoS
    - CVE-2026-67409

 -- Leonidas Da Silva Barbosa Tue, 06 Oct 2026 13:54:08 -0300
Source diff to previous version
CVE-2026-66070 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin
CVE-2026-66077 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, The management UI uses EJS 1.0 in which <%= ... %
CVE-2026-66079 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (lis
CVE-2026-67231 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_f
CVE-2026-67232 RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 s
CVE-2026-67235 RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize (a uint64) was
CVE-2026-67236 RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie
CVE-2026-67237 RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorization heade
CVE-2026-67238 RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ET
CVE-2026-67239 RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificat
CVE-2026-67409 RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Co

Version: 3.12.1-1ubuntu1.6 2026-10-07 15:38:21 UTC

rabbitmq-server (3.12.1-1ubuntu1.6) noble-security; urgency=medium

  * SECURITY UPDATE: Allocation of resources without limits
    - debian/patches/CVE-2026-59248.patch: add a hard limit for HPACK
      integer decoding in bundled cowlib to prevent memory exhaustion
      via crafted HPACK/QPACK prefixed-integer encoding.
    - CVE-2026-59248

 -- Leonidas Da Silva Barbosa Tue, 29 Sep 2026 07:43:50 -0300
Source diff to previous version
CVE-2026-59248 Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on

Version: 3.12.1-1ubuntu1.4 2026-03-26 16:08:13 UTC

  rabbitmq-server (3.12.1-1ubuntu1.4) noble; urgency=medium

  [ Mitchell Dzurick ]
  * Added new dep8 tests (LP: #1679386):
    - d/t/hello-world
    - d/t/publish-subscribe
    - d/t/rpc
    - d/t/work-queue
    - d/t/smoke-test: remove unnecessary redirection and shell set
  * d/watch: update to find upstream tarball, and verify its signature
  * d/upstream/signing-key.asc: added, downloaded from
     https://github.com/rabbitmq/signing-keys/releases/download/3.0/rabbitmq-release-signing-key.asc
Source diff to previous version
1679386 Missing dep8 tests

Version: 3.12.1-1ubuntu1.2 2025-03-31 22:07:07 UTC

  rabbitmq-server (3.12.1-1ubuntu1.2) noble-security; urgency=medium

  * SECURITY UPDATE: XSS vulnerability
    - debian/patches/CVE-2025-30219.patch: sanitize error message in
      management ui.
    - CVE-2025-30219
  * this update does not include the changes from 3.12.1-1ubuntu1.1 as
    included in noble-proposed

 -- Fabian Toepfer <email address hidden> Thu, 27 Mar 2025 17:08:05 +0100
CVE-2025-30219 RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on


About   -   Send Feedback to @ubuntu_updates