CVE-2026-57212CWE-770

RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size

High · published July 10, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
EPSS
0.00433 · 36.6th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-07-10T20:15Z
EPSS history
Timeline
  • 10 JUL 20:15Z
    RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size
    cvelistv5