CVE-2023-46118
published 2023-10-25CVE-2023-46118: RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service…
PriorityP422medium4.9CVSS 3.1
AVNACLPRHUINSUCNINAH
EPSS
1.08%
61.1th percentile
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | rabbitmq-server | < rabbitmq-server 3.10.8-1.1+deb12u1 (bookworm) | rabbitmq-server 3.10.8-1.1+deb12u1 (bookworm) |
| msrc | azl3_rabbitmq-server_3.11.11-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rabbitmq-server_3.13.0-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_rabbitmq-server_3.11.24-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| rabbitmq | rabbitmq-server | < 3.12.7 | 3.12.7 |
| rabbitmq | rabbitmq-server | < 3.11.24 | 3.11.24 |
| rabbitmq | rabbitmq-server | >= 0 < 3.8.9-3+deb11u1 | 3.8.9-3+deb11u1 |
| rabbitmq | rabbitmq-server | >= 0 < 3.10.8-1.1+deb12u1 | 3.10.8-1.1+deb12u1 |
| rabbitmq | rabbitmq-server | >= 0 < 3.10.8-3 | 3.10.8-3 |
| rabbitmq | rabbitmq-server | >= 0 < 3.10.8-3 | 3.10.8-3 |
| vmware | rabbitmq | < 3.11.24 | 3.11.24 |
| vmware | rabbitmq | >= 3.12.0 < 3.12.7 | 3.12.7 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
osv4.9MEDIUM
vendor_debian4.9MEDIUM
vendor_msrc4.9MEDIUM
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
RabbitMQ vulnerability
vendor_ubuntu·2023-11-21
CVE-2023-46118 RabbitMQ vulnerability
Title: RabbitMQ vulnerability
Summary: RabbitMQ could be made to denial of service if it received a specially crafted
HTTP request.
It was discovered that RabbitMQ incorrectly handled certain HTTP requests.
An attacker could possibly use this issue to cause a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
rabbitmq-server: DoS by publishing large messages over the HTTP API
vendor_redhat·2023-10-23·CVSS 4.9
CVE-2023-46118 [MEDIUM] CWE-400 rabbitmq-server: DoS by publishing large messages over the HTTP API
rabbitmq-server: DoS by publishing large messages over the HTTP API
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
A flaw was found in the rabbitmq-server. An authenticated user with sufficient credentials can publish very large messages over the HTTP API and cause the target node to be terminated by an "out-of-memory killer" like mechanism.
Package: rabbitmq-server (Red Hat OpenStack Platf
Microsoft
Denial of Service by publishing large messages over the HTTP API
vendor_msrc·2023-10-10·CVSS 4.9
CVE-2023-46118 [MEDIUM] CWE-400 Denial of Service by publishing large messages over the HTTP API
Denial of Service by publishing large messages over the HTTP API
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference
Debian
CVE-2023-46118: rabbitmq-server - RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not en...
vendor_debian·2023·CVSS 4.9
CVE-2023-46118 [MEDIUM] CVE-2023-46118: rabbitmq-server - RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not en...
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
Scope: local
bookworm: resolved (fixed in 3.10.8-1.1+deb12u1)
bullseye: resolved (fixed in 3.8.9-3+deb11u1)
forky: resolved (fixed in 3.10.8-3)
sid: resolved (fixed in 3.10.8-3)
trixie: resolved (fixed in 3.10.8-3)
GHSA
RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API
ghsa·2026-06-30
CVE-2023-46118 [MEDIUM] CWE-400 RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API
RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API
### Summary
Responsibly disclosed by @NSEcho.
HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages.
### Details
An authenticated user with sufficient credentials can publish a very large messages over the HTTP API
and cause target node to be terminated by an "out-of-memory killer"-like mechanism.
A PoC was provided to Team RabbitMQ privately.
### Impact
Denial of Service
OSV
CVE-2023-46118: RabbitMQ is a multi-protocol messaging and streaming broker
osv·2023-10-25·CVSS 4.9
CVE-2023-46118 [MEDIUM] CVE-2023-46118: RabbitMQ is a multi-protocol messaging and streaming broker
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpghttps://lists.debian.org/debian-lts-announce/2023/12/msg00009.htmlhttps://www.debian.org/security/2023/dsa-5571https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpghttps://lists.debian.org/debian-lts-announce/2023/12/msg00009.htmlhttps://www.debian.org/security/2023/dsa-5571
2023-10-25
Published