CVE-2023-46118

RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.

Affected products

Astra Linux, Linuxmint, Rabbitmq, Red Os, Suse, Ubuntu

Vmware Rabbitmq

< 3.11.24, 3.12.7

Fix

Available

CVSS 3.1

4.9 MEDIUM

EPSS

1.1% (63th percentile)

Weakness

CWE-400

NVD status

Modified

Published

2023-10-24

No exploit for CVE-2023-46118 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.