CVE-2026-57212: RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size
RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmqmanagement HTTP API accepts oversized valid JSON bodies on withdecode and directrequest paths because readcompletebody checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.13.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.0.19 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.1.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.2.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57212?
The severity of CVE-2026-57212 is rated as high with a score of 7.1.
How do I fix CVE-2026-57212?
To fix CVE-2026-57212, upgrade RabbitMQ to versions 3.13.14, 4.0.19, 4.1.10, or 4.2.5 or later.
What are the implications of CVE-2026-57212?
CVE-2026-57212 allows the RabbitMQ management HTTP API to accept oversized JSON bodies, potentially leading to denial of service or resource exhaustion.
Which RabbitMQ versions are affected by CVE-2026-57212?
CVE-2026-57212 affects RabbitMQ versions prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5.
What components are impacted by CVE-2026-57212?
CVE-2026-57212 impacts the RabbitMQ management HTTP API when handling oversized requests.