CVE-2026-57212

Katalog CVE

CVSS 7.7 · High EPSS 0,43%

Kerentanan Allocation of Resources Without Limits or Throttling pada broadcom rabbitmq server. Skor CVSS 3.1 7.7 (High) menurut NVD.

Deskripsi (NVD)

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

Rincian

Terbit di NVD

10 Juli 2026

Terakhir diubah

13 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cmq-vp28-xqrj exploit · advisory vendor
• https://github.com/rabbitmq/rabbitmq-server/commit/3976d148901bdfa82e1cd60b7a4534e073266ba5 patch
• https://github.com/rabbitmq/rabbitmq-server/commit/b8fc2ef7c50a2797d15e1ea7cf34f290032303bb patch
• https://github.com/rabbitmq/rabbitmq-server/pull/15712 issue tracking · patch
• https://github.com/rabbitmq/rabbitmq-server/pull/15714 issue tracking · patch
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.5 release notes