# RabbitMQ vulnerabilities Source: https://junglewise.ai/threats/vendors/rabbitmq Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/rabbitmq.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 44 vulnerabilities in RabbitMQ: 0 in the last 7 days and 43 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-107386, was published on 8 October 2026. Nothing in the last four weeks, down from 38 vulnerabilities in the four before. 0 critical against 3. 4 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 43 - All time: 44 (3 critical, 0 exploited in the wild) ## About RabbitMQ A widely used open-source message broker software originally developed by Rabbit Technologies Ltd. and now part of Broadcom. ## Latest RabbitMQ vulnerabilities - [CVE-2026-107386: amqp091-go pre-negotiation frame limit bypass in connection reader](https://junglewise.ai/threats/cve-2026-107386-amqp091-go-pre-negotiation-frame-limit-is-not-enforced-to-4kb) (medium, CVSS 4, published 8 Oct 2026) - [CVE-2026-106123: RabbitMQ Java client library credential disclosure in error messages](https://junglewise.ai/threats/cve-2026-106123-the-rabbitmq-java-client-library-allows-java-and-jvm-based) (medium, CVSS 4, published 6 Oct 2026) - [CVE-2026-106122: RabbitMQ Java client library UTF-8 parsing denial of service](https://junglewise.ai/threats/cve-2026-106122-the-rabbitmq-java-client-library-allows-java-and-jvm-based) (medium, CVSS 4, published 6 Oct 2026) - [CVE-2026-106121: RabbitMQ Java client library JSON parser denial of service](https://junglewise.ai/threats/cve-2026-106121-the-rabbitmq-java-client-library-allows-java-and-jvm-based) (medium, CVSS 4.9, published 6 Oct 2026) - [CVE-2026-67420: RabbitMQ OAuth privilege escalation via stale token tags](https://junglewise.ai/threats/cve-2026-67420-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-67419: RabbitMQ topic exchange denial of service via duplicate matchers](https://junglewise.ai/threats/cve-2026-67419-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-4-3-5-an) (info, published 25 Sep 2026) - [CVE-2026-67415: RabbitMQ Shovel denial of service via atom exhaustion](https://junglewise.ai/threats/cve-2026-67415-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-2) (info, published 25 Sep 2026) - [CVE-2026-67411: RabbitMQ MQTT loopback user bypass via PROXY Protocol](https://junglewise.ai/threats/cve-2026-67411-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-67410: RabbitMQ OAuth2 client secret exposure via unauthenticated endpoint](https://junglewise.ai/threats/cve-2026-67410-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-3) (info, published 25 Sep 2026) - [CVE-2026-67409: RabbitMQ JWKS fetch ignores HTTP response status code](https://junglewise.ai/threats/cve-2026-67409-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-4) (info, published 25 Sep 2026) - [CVE-2026-67406: RabbitMQ Shovel credentials exposure in crash dumps](https://junglewise.ai/threats/cve-2026-67406-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-3) (info, published 25 Sep 2026) - [CVE-2026-67241: RabbitMQ AMQP 1.0 alternate-exchange permission bypass](https://junglewise.ai/threats/cve-2026-67241-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-2) (info, published 25 Sep 2026) - [CVE-2026-67239: RabbitMQ stored XSS in stream-management UI via TLS peer-certificate DN](https://junglewise.ai/threats/cve-2026-67239-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-67237: RabbitMQ reflected XSS in OAuth bootstrap management UI](https://junglewise.ai/threats/cve-2026-67237-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-2) (info, published 25 Sep 2026) - [CVE-2026-67234: RabbitMQ non-RFC-conformant cookie name in auth mechanism](https://junglewise.ai/threats/cve-2026-67234-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-2) (info, published 25 Sep 2026) - [CVE-2026-67230: RabbitMQ Web STOMP WebSocket denial of service](https://junglewise.ai/threats/cve-2026-67230-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3) (info, published 25 Sep 2026) - [CVE-2026-67227: RabbitMQ atom exhaustion in global parameters API](https://junglewise.ai/threats/cve-2026-67227-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0) (info, published 25 Sep 2026) - [CVE-2026-67223: RabbitMQ LDAP DN injection in auth backend](https://junglewise.ai/threats/cve-2026-67223-rabbitmq-is-a-messaging-and-streaming-broker-the-advisory) (info, published 25 Sep 2026) - [CVE-2026-61837: RabbitMQ AMQP 1.0 management binding enumeration](https://junglewise.ai/threats/cve-2026-61837-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-3) (info, published 25 Sep 2026) - [CVE-2026-67240: RabbitMQ regex backtracking CPU amplification in stream queue filters](https://junglewise.ai/threats/cve-2026-67240-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-4) (info, published 23 Sep 2026) - [CVE-2026-67232: RabbitMQ zlib bomb denial of service in Web-MQTT WebSocket](https://junglewise.ai/threats/cve-2026-67232-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-67224: RabbitMQ path traversal in tracing plugin](https://junglewise.ai/threats/cve-2026-67224-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-66075: RabbitMQ privilege escalation in federation link restart](https://junglewise.ai/threats/cve-2026-66075-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-66074: RabbitMQ regex denial of service in management API](https://junglewise.ai/threats/cve-2026-66074-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) - [CVE-2026-66068: RabbitMQ Shovel plaintext credentials in debug logs](https://junglewise.ai/threats/cve-2026-66068-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-3) (info, published 23 Sep 2026) ## Most severe RabbitMQ vulnerabilities - [CVE-2026-77411: RabbitMQ amqp091-go protocol desynchronization via integer overflow](https://junglewise.ai/threats/cve-2026-77411-rabbitmq-amqp091-go-protocol-desynchronization-via-integer) (critical, CVSS 4, published 16 Sep 2026) - [CVE-2026-77408: RabbitMQ amqp091-go silent data truncation via shortstr integer overflow](https://junglewise.ai/threats/cve-2026-77408-rabbitmq-amqp091-go-silent-data-truncation-via-shortstr-integer) (critical, CVSS 4, published 16 Sep 2026) - [CVE-2026-77405: RabbitMQ amqp091-go missing TLS minimum version configuration](https://junglewise.ai/threats/cve-2026-77405-rabbitmq-amqp091-go-missing-tls-minimum-version-configuration) (critical, CVSS 4, published 16 Sep 2026) - [CVE-2026-9133: Amazon MQ rabbitmq-aws arbitrary file read via active debug code](https://junglewise.ai/threats/cve-2026-9133-amazon-mq-rabbitmq-aws-arbitrary-file-read-via-active-debug-code) (high, CVSS 7.7, published 20 May 2026) - [CVE-2026-69219: RabbitMQ Java client memory allocation DoS in ValueReader](https://junglewise.ai/threats/cve-2026-69219-rabbitmq-java-client-memory-allocation-dos-in-valuereader) (high, CVSS 4, published 18 Aug 2026) - [CVE-2026-69220: RabbitMQ Java client unbounded recursion in ValueReader](https://junglewise.ai/threats/cve-2026-69220-rabbitmq-java-client-unbounded-recursion-in-valuereader) (high, CVSS 4, published 18 Aug 2026) - [CVE-2026-63337: RabbitMQ Java client unsafe reflection in JSON-RPC](https://junglewise.ai/threats/cve-2026-63337-rabbitmq-java-client-unsafe-reflection-in-json-rpc) (high, CVSS 4, published 18 Aug 2026) - [CVE-2026-79921: RabbitMQ amqp091-go memory exhaustion in frame parsing](https://junglewise.ai/threats/cve-2026-79921-rabbitmq-amqp091-go-memory-exhaustion-in-frame-parsing) (high, CVSS 4, published 26 Aug 2026) - [CVE-2026-77412: RabbitMQ amqp091-go denial of service via malicious field length](https://junglewise.ai/threats/cve-2026-77412-rabbitmq-amqp091-go-denial-of-service-via-malicious-field-length) (high, CVSS 4, published 16 Sep 2026) - [CVE-2026-77410: RabbitMQ amqp091-go resource exhaustion via unbounded buffer allocation](https://junglewise.ai/threats/cve-2026-77410-rabbitmq-amqp091-go-resource-exhaustion-via-unbounded-buffer) (high, CVSS 4, published 16 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 38 vulnerabilities in the four before. 0 critical against 3. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 4 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 10 | 3 | 0 | | 21 Sep 2026 | 24 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 4 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## RabbitMQ technologies - [RabbitMQ](https://junglewise.ai/threats/technologies/rabbitmq-rabbitmq): 24 vulnerabilities - [RabbitMQ Amqp091-Go](https://junglewise.ai/threats/technologies/amqp091-go): 12 vulnerabilities - [RabbitMQ Amqp-Client](https://junglewise.ai/threats/technologies/amqp-client): 4 vulnerabilities - [RabbitMQ Java client library](https://junglewise.ai/threats/technologies/java-client-library): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "RabbitMQ vulnerabilities", https://junglewise.ai/threats/vendors/rabbitmq, 9 November 2026.