Product Release Advisory - Open Source RabbitMQ 4.0.24

Product/Component

App Suite

7 more products

Notification Id

38351

Last Updated

04 September 2026

Initial Publication Date

04 September 2026

Status

CLOSED

Severity

HIGH

CVSS Base Score

WorkAround

Affected CVE

Advisory ID:	TNZ-2026-0382
Severity:	[High]
Issue Date:	09-04-2026
Updated on:
Synopsis	Open Source RabbitMQ 4.0.24 resolves 10 security vulnerabilities: CVE-2026-67421 (medium): Stored HTML injection in RabbitMQ Management OAuth error handling GHSA-6gmw-wxch-cvvc (medium, CVE pending): Shovel URI credentials disclosed to read-only monitoring users via the shovel management HTTP API GHSA-6xpg-rfmh-grhq (medium, CVE pending): STOMP pre-authentication frame size limit is not enforced GHSA-3526-xvv4-q9mr (medium, CVE pending): RabbitMQ administrator RCE through reflected Erlang distribution authentication CVE-2026-67416 (medium): AMQP 1.0 symbolic body descriptor prefix collisions bypass validation CVE-2026-67414 (medium): RabbitMQ AMQP 1.0 parser amplification memory-exhaustion DoS via zero-width array aggregation CVE-2026-67412 (medium): Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access GHSA-27gv-h5q6-cpwg (low, CVE pending): RabbitMQ policymaker RCE through federation-management nonmember RPC and distribution reflection CVE-2026-67418 (low): MQTT 5.0 inapplicable PUBLISH property disconnects matching subscribers CVE-2026-67420 (low): OAuth credential refresh retains revoked runtime tags https://nvd.nist.gov/vuln/detail/CVE-2026-67421 https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6gmw-wxch-cvvc https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6xpg-rfmh-grhq https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-3526-xvv4-q9mr https://nvd.nist.gov/vuln/detail/CVE-2026-67416 https://nvd.nist.gov/vuln/detail/CVE-2026-67414 https://nvd.nist.gov/vuln/detail/CVE-2026-67412 https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-27gv-h5q6-cpwg https://nvd.nist.gov/vuln/detail/CVE-2026-67418 https://nvd.nist.gov/vuln/detail/CVE-2026-67420

Product Version Release Advisory

Open Source RabbitMQ 4.0.24

https://techdocs.broadcom.com/us/en/vmware-tanzu/data-solutions/open-source-rabbitmq/4-0/opn-src-rabbitmq/site-release-notes.html

Security Fixes

This release has the following security fixes, listed by component and area.

Component	Vulnerabilities Resolved
Management Plugin (OAuth2 UI)	CVE-2026-67421 (medium)
Shovel Management Plugin	GHSA-6gmw-wxch-cvvc (medium)
STOMP Plugin	GHSA-6xpg-rfmh-grhq (medium)
Core (Erlang distribution)	GHSA-3526-xvv4-q9mr (medium)
Core (AMQP 1.0)	CVE-2026-67416 (medium)
Core (AMQP 1.0)	CVE-2026-67414 (medium)
Federation Plugin	CVE-2026-67412 (medium)
Federation Management Plugin	GHSA-27gv-h5q6-cpwg (low)
MQTT Plugin	CVE-2026-67418 (low)
OAuth2 Plugin	CVE-2026-67420 (low)

Product Versions Affected

Open Source RabbitMQ >= 4.0.0, < 4.0.24

Other Products Versions Affected

VMware Tanzu RabbitMQ >= 4.0.0, < 4.0.24
VMware Tanzu RabbitMQ on Kubernetes >= 4.0.0, < 4.0.24