This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-57212 →

DEBIAN-CVE-2026-57212

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JS...

Original description

The description as published by the source.

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 rabbitmq-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 rabbitmq-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 rabbitmq-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2"}]}]

References

advisory security-tracker.debian.org