{"id":"CVE-2023-46118","title":"RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API","summary":"RabbitMQ vulnerable to Denial of Service by publishing large messages over the HTTP API","severity":"medium","cvss":4.9,"cwe":["CWE-400"],"vendor":"rabbit_common","product":"rabbit_common","ecosystem":"erlang","affected":["rabbit_common >= 3.12.0, < 3.12.7","rabbit_common >= 3.11.0, < 3.11.24"],"patched":["rabbit_common 3.12.7","rabbit_common 3.11.24"],"published":"2026-06-30","updated":"2026-06-30","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-w6cq-9cf4-gqpg","references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46118"},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00009.html"},{"url":"https://www.debian.org/security/2023/dsa-5571"},{"url":"https://github.com/advisories/GHSA-w6cq-9cf4-gqpg"}],"tags":["ghsa","erlang"],"epss":0.01086,"epssPercentile":0.63359,"ingestedAt":"2026-06-30T17:40:12.492Z","slug":"CVE-2023-46118","body":"## Overview\n\n### Summary\n\nResponsibly disclosed by @NSEcho.\n\nHTTP API did not enforce an HTTP request body limit, making it vulnerable for DoS attacks with very large messages. \n\n### Details\n\nAn authenticated user with sufficient credentials can publish a very large messages over the HTTP API\nand cause target node to be terminated by an \"out-of-memory killer\"-like mechanism.\n\nA PoC was provided to Team RabbitMQ privately.\n\n### Impact\n\nDenial of Service\n\n## Affected packages\n\n- `rabbit_common >= 3.12.0, < 3.12.7`\n- `rabbit_common >= 3.11.0, < 3.11.24`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `rabbit_common 3.12.7`\n- `rabbit_common 3.11.24`","depth":"sunlit","depthScore":27,"depthScoreParts":{"impact":27,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}