GHSA-w6cq-9cf4-gqpg
RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Hex | rabbit_common | >= 3.12.0, < 3.12.7 | 3.12.7 |
| Hex | rabbit_common | >= 3.11.0, < 3.11.24 | 3.11.24 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
Responsibly disclosed by @NSEcho.
HTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages.
### Details
An authenticated user with sufficient credentials can publish a very large messages over the HTTP API
and cause target node to be terminated by an "out-of-memory killer"-like mechanism.
A PoC was provided to Team RabbitMQ privately.
### Impact
Denial of Service
References
External links from the advisory. They lead to third-party sites.