CVE-2023-46118
Denial of Service by publishing large messages over the HTTP API
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 4.9EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
24 Oct 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected products
rabbitmq · rabbitmq-serverWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →