Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
rabbitmq/rabbitmq-server
main @ 7c020d8
185
Fixes
17
CVEs
CRITICAL
Peak severity
18.2%
Coverage
Highlights
Auth Bypass: 69 prior fixes. Scrutinize any change in this area.
rabbitmq_management: most-fixed (13 issues). Treat as high-risk during review.
47 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The Native MQTT adapter has historically suffered from critical authentication and authorization bypasses, including acceptance of empty passwords, lack of topic write/read validations on connection/Will messages, and missing variable expansion. Developers must guarantee that X.509 client certificate usernames and SASL credentials are robustly coerced and verified.
Denial of Service: Memory exhaustion and Erlang process/node crashes frequently occur during protocol parsing or formatting due to unbounded binary assembly, unsafe atom creation, and lack of pre-authentication heap limits. Input sizes and structures must be explicitly checked during early packet read loops.
Auth Bypass: Stream-specific metadata and tracking API paths have bypassed permission validation when routing, fetching topologies, or returning tracking stats. Proper read authorization checks must gate all stream API entry points.