Product Release Advisory - Open Source RabbitMQ 3.13.14

RabbitMQ

6 more products

37881

23 July 2026

08 July 2026

CLOSED

HIGH

Product Release Advisory

Advisory ID:

TNZ-2026-0328

Severity:

[High]

Issue Date:

2026-06-18

Updated on:

2026-07-23

Synopsis

Open Source RabbitMQ 3.13.14 resolves 2 security vulnerabilities:


• CVE-2026-57212 (high): RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size

• CVE-2026-57213 (medium): Stored XSS in RabbitMQ federation management plugin via unsanitized consumer_tag rendering


https://nvd.nist.gov/vuln/detail/CVE-2026-57212

https://nvd.nist.gov/vuln/detail/CVE-2026-57213

 

Product Version Release Advisory

Security Fixes

This release has the following security fixes, listed by component and area.

Component

Vulnerabilities Resolved

Management Plugin

CVE-2026-57212 (high)

Management Plugin

CVE-2026-57213 (medium)

 

Product Versions Affected

  • Open Source RabbitMQ >= 3.13.0, < 3.13.14

Other Products Versions Affected

  • VMware Tanzu RabbitMQ >= 3.13.0, < 3.13.14
  • VMware Tanzu RabbitMQ on Kubernetes >= 3.13.0, < 3.13.14

History

2026-07-14: Initial vulnerability report published.

Contact

E-mail: [email protected]

VMware Tanzu Security Advisories

https://tanzu.vmware.com/security