Описание
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max_frame_size nor login_timeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frames and accumulate unbounded pre-authentication state. The rabbitmq_web_stomp plugin must be enabled, and no authentication is required to reach the vulnerable path. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
A flaw was found in RabbitMQ. When the Web STOMP plugin is enabled, the WebSocket handler fails to enforce maximum frame size limits or login timeouts prior to client authentication. An unauthenticated remote attacker can exploit this vulnerability by sending a continuous stream of small frames to keep connections open and accumulate pre-authentication state, leading to resource exhaustion and a Denial of Service (DoS).
Отчет
This vulnerability is rated as Moderate impact for Red Hat products because it leads solely to a denial of service through resource exhaustion without compromising system confidentiality or integrity. In standard Red Hat deployments, such as Red Hat OpenStack Platform, RabbitMQ operates over standard AMQP protocols and the Web STOMP plugin is not enabled by default. Furthermore, message broker traffic is typically confined to private, trusted networks, limiting exposure to untrusted remote attackers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | rabbitmq-server4.2 | Will not fix | ||
| Red Hat OpenStack Platform 13 (Queens) | rabbitmq-server | Out of support scope | ||
| Red Hat OpenStack Platform 16.2 | rabbitmq-server | Out of support scope | ||
| Red Hat OpenStack Platform 17.1 | rabbitmq-server | Out of support scope | ||
| Red Hat OpenStack Platform 18.0 | rabbitmq-server | Fix deferred | ||
| Red Hat Hardened Images | rabbitmq-server4-3-main-4.3.6-1.hum1 | Fixed | RHSA-2026:67552 | 15.09.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max_frame_size nor login_timeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frames and accumulate unbounded pre-authentication state. The rabbitmq_web_stomp plugin must be enabled, and no authentication is required to reach the vulnerable path. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max_frame_size nor login_timeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frames and accumulate unbounded pre-authentication state. The rabbitmq_web_stomp plugin must be enabled, and no authentication is required to reach the vulnerable path. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.1 ...
5.3 Medium
CVSS3