UpHeron
All vulnerabilities

Servers and applications

CVE-2023-46118

Denial of Service by publishing large messages over the HTTP API

Severity
Medium 4.9
Published
23 Oct 2023
Last changed
30 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.11.24, 3.12.7
Also known as
GHSA-w6cq-9cf4-gqpg
Sources
NVD, Project advisories (GitHub)

Description

RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This…

Affected software

SoftwareAffected versions
RabbitMQServers and applications · cpe:a:vmware:rabbitmq
  • Every version before 3.11.24
  • From 3.12.0 before 3.12.7
RabbitMQServers and applications · github:rabbitmq/rabbitmq-server
  • From 3.11.0 before 3.11.24
  • From 3.12.0 before 3.12.7

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-46118
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-46118
  • GitHub Advisory Database https://github.com/advisories/GHSA-w6cq-9cf4-gqpg
  • github.com https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg