{
  "cveId": "CVE-2023-46118",
  "url": "https://patchblox.com/security/cve/CVE-2023-46118",
  "summary": "CVE-2023-46118 is fixed in 4 products on 1 platform, first by rabbitmq-server 3.8.2-0ubuntu1.5, released October 25, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "rabbitmq-server: RabbitMQ is a multi-protocol messaging and streaming broker",
  "description": "RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API didnot enforce an HTTP request body limit, making it vulnerable for denial ofservice (DoS) attacks with very large messages. An authenticated user withsufficient credentials can publish a very large messages over the HTTP APIand cause target node to be terminated by an \u0022out-of-memory killer\u0022-likemechanism. This vulnerability has been patched in versions 3.11.24 and3.12.7.",
  "published": "2023-10-25T11:17:00Z",
  "severity": "Medium",
  "cvss": 4.9,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.01318,
  "epssPercentile": 0.71192,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "elixir115",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "1.15.7-150300.7.5.1",
      "fix": "SUSE-FU-2024:2078-1",
      "url": "https://patchblox.com/security/fix/linux/suse-fu-2024-2078-1",
      "released": "2024-06-19T03:36:36Z"
    },
    {
      "platform": "linux",
      "product": "elixir115",
      "release": "sles 15.6",
      "fixedVersion": "1.15.7-150300.7.5.1",
      "fix": "SUSE-FU-2024:2078-1",
      "url": "https://patchblox.com/security/fix/linux/suse-fu-2024-2078-1",
      "released": "2024-06-19T03:36:36Z"
    },
    {
      "platform": "linux",
      "product": "erlang26",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "26.2.1-150300.7.5.1",
      "fix": "SUSE-FU-2024:2078-1",
      "url": "https://patchblox.com/security/fix/linux/suse-fu-2024-2078-1",
      "released": "2024-06-19T03:36:36Z"
    },
    {
      "platform": "linux",
      "product": "erlang26",
      "release": "sles 15.6",
      "fixedVersion": "26.2.1-150300.7.5.1",
      "fix": "SUSE-FU-2024:2078-1",
      "url": "https://patchblox.com/security/fix/linux/suse-fu-2024-2078-1",
      "released": "2024-06-19T03:36:36Z"
    },
    {
      "platform": "linux",
      "product": "rabbitmq-server",
      "release": "Debian 11.6 (bullseye)",
      "fixedVersion": "3.8.9-3\u002Bdeb11u1",
      "fix": "DSA-5571-1",
      "url": "https://patchblox.com/security/fix/linux/dsa-5571-1",
      "released": "2023-12-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rabbitmq-server",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "3.10.8-1.1\u002Bdeb12u1",
      "fix": "DSA-5571-1",
      "url": "https://patchblox.com/security/fix/linux/dsa-5571-1",
      "released": "2023-12-01T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "rabbitmq-server",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "3.10.8-3",
      "fix": "DEBIAN-CVE-2023-46118",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-46118",
      "released": "2023-10-25T18:17:36Z"
    },
    {
      "platform": "linux",
      "product": "rabbitmq-server",
      "release": "Debian 14",
      "fixedVersion": "3.10.8-3",
      "fix": "DEBIAN-CVE-2023-46118",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-46118",
      "released": "2023-10-25T18:17:36Z"
    },
    {
      "platform": "linux",
      "product": "rabbitmq-server",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "3.8.2-0ubuntu1.5",
      "fix": "rabbitmq-server 3.8.2-0ubuntu1.5",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-rabbitmq-server-3.8.2-0ubuntu1.5",
      "released": "2023-10-25T11:17:00Z"
    },
    {
      "platform": "linux",
      "product": "rabbitmq-server",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "3.9.13-1ubuntu0.22.04.2",
      "fix": "rabbitmq-server 3.9.13-1ubuntu0.22.04.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-rabbitmq-server-3.9.13-1ubuntu0.22.04.2",
      "released": "2023-10-25T11:17:00Z"
    },
    {
      "platform": "linux",
      "product": "rabbitmq-server",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "3.12.1-1ubuntu1",
      "fix": "rabbitmq-server 3.12.1-1ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-rabbitmq-server-3.12.1-1ubuntu1",
      "released": "2023-10-25T11:17:00Z"
    },
    {
      "platform": "linux",
      "product": "rabbitmq-server",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "3.12.1-1ubuntu1",
      "fix": "rabbitmq-server 3.12.1-1ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-rabbitmq-server-3.12.1-1ubuntu1",
      "released": "2026-01-16T01:42:23Z"
    },
    {
      "platform": "linux",
      "product": "rabbitmq-server",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "3.12.1-1ubuntu1",
      "fix": "rabbitmq-server 3.12.1-1ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-rabbitmq-server-3.12.1-1ubuntu1",
      "released": "2026-01-16T01:42:24Z"
    },
    {
      "platform": "linux",
      "product": "rabbitmq-server313",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "3.13.1-150600.13.5.3",
      "fix": "SUSE-FU-2024:2078-1",
      "url": "https://patchblox.com/security/fix/linux/suse-fu-2024-2078-1",
      "released": "2024-06-19T03:36:36Z"
    },
    {
      "platform": "linux",
      "product": "rabbitmq-server313",
      "release": "sles 15.6",
      "fixedVersion": "3.13.1-150600.13.5.3",
      "fix": "SUSE-FU-2024:2078-1",
      "url": "https://patchblox.com/security/fix/linux/suse-fu-2024-2078-1",
      "released": "2024-06-19T03:36:36Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-12T01:51:14Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}