CVE-2023-46118: Denial of Service by publishing large messages over the HTTP API
Vulnerability summary
CVE-2023-46118 is a medium (CVSS 4.9) Uncontrolled Resource Consumption vulnerability in rabbitmq rabbitmq-server. EPSS estimates a 1.32% chance of exploitation in the next 30 days, higher than 70.8% of scored vulnerabilities.
Not severe (CVSS 4.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 24-10-2023PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · Red hatEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- NVDNIST4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.32%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
Increase +0.23 pp
From 1.09% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Opensuse2 products
- rabbitmq-server&distro=openSUSE Leap 15.4< 3.8.11-150300.3.14.1
- rabbitmq-server&distro=openSUSE Leap 15.5< 3.8.11-150300.3.14.1
Suse2 products
- rabbitmq-server&distro=SUSE Linux Enterprise Module for Server Applications 15 SP4< 3.8.11-150300.3.14.1
- rabbitmq-server&distro=SUSE Linux Enterprise Module for Server Applications 15 SP5< 3.8.11-150300.3.14.1
Debian1 product
- rabbitmq-server< 3.8.9-3+deb11u1 | < 3.8.2-1+deb10u2 | < 3.10.8-1.1+deb12u1 | < 3.10.8-3
Rabbitmq1 product
- rabbitmq-server< 3.12.7 | < 3.11.24
Redhat1 product
- rabbitmq-server< 0:3.9.10-3.el9ost
Ubuntu1 product
- rabbitmq-serverAll versions (No fix recorded) | < 3.8.2-0ubuntu1.5 | < 3.9.13-1ubuntu0.22.04.2 | < 3.12.1-1ubuntu1
Vmware1 product
- rabbitmq< 3.11.24 | ≥ 3.12.0, < 3.12.7
7 vendors · 9 products
References
16 links- github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpgX Refsource CONFIRMARTICLEREPORTVendor Advisory
