CVE-2023-46118

Name	CVE-2023-46118
Description	RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3687-1, DSA-5571-1
Debian Bugs	1056723

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rabbitmq-server (PTS)	bullseye (security), bullseye	3.8.9-3+deb11u1	fixed
	bookworm, bookworm (security)	3.10.8-1.1+deb12u1	fixed
	trixie	3.10.8-4	fixed
	sid	4.0.5-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
rabbitmq-server	source	buster	3.8.2-1+deb10u2	DLA-3687-1
rabbitmq-server	source	bullseye	3.8.9-3+deb11u1	DSA-5571-1
rabbitmq-server	source	bookworm	3.10.8-1.1+deb12u1	DSA-5571-1
rabbitmq-server	source	(unstable)	3.10.8-3		1056723

https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg
https://github.com/rabbitmq/rabbitmq-server/pull/9708