CVE-2023-46118

CWE-400 — Uncontrolled Resource Consumption7 documents7 sources
Severity
4.9MEDIUM
EPSS
0.3%
top 48.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Rabbitmq Rabbitmq-serverVmware Rabbitmq
Timeline
PublishedOct 25
Latest updateNov 21

Description

RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HExploitability: 1.2 | Impact: 3.6

Affected Packages3 packages

▶NVDvmware/rabbitmq3.12.0 — 3.12.7+1
▶CVEListV5rabbitmq/rabbitmq-server< 3.12.7+1
▶Debianrabbitmq-server< 3.8.9-3+deb11u1+3

🔴Vulnerability Details

2
OSV
CVE-2023-46118: RabbitMQ is a multi-protocol messaging and streaming broker↗2023-10-25
▶
CVEList
Denial of Service by publishing large messages over the HTTP API↗2023-10-24
▶

📋Vendor Advisories

4
Ubuntu
RabbitMQ vulnerability↗2023-11-21
▶
Red Hat
rabbitmq-server: DoS by publishing large messages over the HTTP API↗2023-10-23
▶
Microsoft
Denial of Service by publishing large messages over the HTTP API↗2023-10-10
▶
Debian
CVE-2023-46118: rabbitmq-server - RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not en...↗2023
▶