Vulnerability Description
RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Broadcom | Rabbitmq Server | >= 3.13.0, < 4.2.5 |
Related Weaknesses (CWE)
References
- https://github.com/rabbitmq/rabbitmq-server/commit/3976d148901bdfa82e1cd60b7a453Patch
- https://github.com/rabbitmq/rabbitmq-server/commit/b8fc2ef7c50a2797d15e1ea7cf34fPatch
- https://github.com/rabbitmq/rabbitmq-server/pull/15712Issue TrackingPatch
- https://github.com/rabbitmq/rabbitmq-server/pull/15714Issue TrackingPatch
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.5Release Notes
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cmq-vp28-xExploitVendor Advisory
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cmq-vp28-xExploitVendor Advisory
FAQ
What is CVE-2026-57212?
CVE-2026-57212 is a vulnerability with a CVSS score of 7.7 (HIGH). RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths ...
How severe is CVE-2026-57212?
CVE-2026-57212 has been rated HIGH with a CVSS base score of 7.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-57212?
Check the references section above for vendor advisories and patch information. Affected products include: Broadcom Rabbitmq Server.