{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nrabbitmq-server4.3:\n  * rabbitmq-server4.3-4.3.2-1.hum1 (aarch64, x86_64)\n  * rabbitmq-server4.3-4.3.2-1.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:35939",
        "url": "https://access.redhat.com/errata/RHSA-2026:35939"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57217",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57217"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57214",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57214"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57219",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57219"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57220",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57220"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57212",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57212"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57221",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57221"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57211",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57211"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57213",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57213"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57218",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57218"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57215",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57215"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-57216",
        "url": "https://access.redhat.com/security/cve/CVE-2026-57216"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35939.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-07-29T03:45:34+00:00",
      "generator": {
        "date": "2026-07-29T03:45:34+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.7"
        }
      },
      "id": "RHSA-2026:35939",
      "initial_release_date": "2026-07-06T15:02:20+00:00",
      "revision_history": [
        {
          "date": "2026-07-06T15:02:20+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-07-25T05:39:32+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-07-29T03:45:34+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rabbitmq-server4-3-main@aarch64",
                "product": {
                  "name": "rabbitmq-server4-3-main@aarch64",
                  "product_id": "rabbitmq-server4-3-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rabbitmq-server4.3@4.3.2-1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rabbitmq-server4-3-main@src",
                "product": {
                  "name": "rabbitmq-server4-3-main@src",
                  "product_id": "rabbitmq-server4-3-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rabbitmq-server4.3@4.3.2-1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rabbitmq-server4-3-main@x86_64",
                "product": {
                  "name": "rabbitmq-server4-3-main@x86_64",
                  "product_id": "rabbitmq-server4-3-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rabbitmq-server4.3@4.3.2-1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rabbitmq-server4-3-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64"
        },
        "product_reference": "rabbitmq-server4-3-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rabbitmq-server4-3-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:rabbitmq-server4-3-main@src"
        },
        "product_reference": "rabbitmq-server4-3-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rabbitmq-server4-3-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
        },
        "product_reference": "rabbitmq-server4-3-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-57211",
      "cwe": {
        "id": "CWE-76",
        "name": "Improper Neutralization of Equivalent Special Elements"
      },
      "discovery_date": "2026-07-10T21:01:38.205465+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499215"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ. The RabbitMQ management plugin static file handler, `rabbit_mgmt_wm_static`, on Windows can be exploited when multiple management extension plugins are enabled. An attacker can pass specially crafted URL-encoded backslashes, bypassing path validation. This can lead to outbound DNS and Server Message Block (SMB) requests to attacker-controlled network paths, potentially disclosing sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rabbitmq: RabbitMQ: Information disclosure via path validation bypass in management plugin",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57211"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499215",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499215"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57211",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57211"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57211",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57211"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/39c3a8e9c71da0403d8dfc13f700e60c936e3682",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/39c3a8e9c71da0403d8dfc13f700e60c936e3682"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/6730797f6a34b4e8308cea60adf1243857e70204",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/6730797f6a34b4e8308cea60adf1243857e70204"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/15803",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15803"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-7v84-m3g5-vxq6",
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-7v84-m3g5-vxq6"
        }
      ],
      "release_date": "2026-07-10T20:16:01.719000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-06T15:02:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:35939"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rabbitmq: RabbitMQ: Information disclosure via path validation bypass in management plugin"
    },
    {
      "cve": "CVE-2026-57212",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-10T21:01:03.348698+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499205"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker could exploit this vulnerability by sending oversized JSON bodies to the rabbitmq_management HTTP API. The API\u0027s body size check is incomplete, allowing the final combined size to exceed limits. This could lead to a Denial of Service (DoS) due to excessive resource consumption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rabbitmq-server: RabbitMQ: Denial of Service via oversized JSON bodies in HTTP API",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57212"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499205",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499205"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57212",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57212"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57212",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57212"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/3976d148901bdfa82e1cd60b7a4534e073266ba5",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/3976d148901bdfa82e1cd60b7a4534e073266ba5"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/b8fc2ef7c50a2797d15e1ea7cf34f290032303bb",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/b8fc2ef7c50a2797d15e1ea7cf34f290032303bb"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/15712",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15712"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/15714",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15714"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.5",
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cmq-vp28-xqrj",
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cmq-vp28-xqrj"
        }
      ],
      "release_date": "2026-07-10T20:15:28.422000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-06T15:02:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:35939"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rabbitmq-server: RabbitMQ: Denial of Service via oversized JSON bodies in HTTP API"
    },
    {
      "cve": "CVE-2026-57213",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-10T21:01:13.630487+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499208"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the RabbitMQ `rabbitmq_federation_management` plugin. This cross-site scripting (XSS) vulnerability occurs because the `consumer_tag` field on the Federation Status page does not properly escape HTML. A user with permissions to configure a federation upstream or policy can exploit this by injecting malicious JavaScript. When another user views the Federation Status page, the injected script executes in their browser, potentially leading to information disclosure or unauthorized actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rabbitmq-server: RabbitMQ: Information Disclosure via Cross-Site Scripting in Federation Management",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57213"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499208",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499208"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57213",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57213"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57213",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57213"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/33dedfe4fd53ff009cc67ab36358d0624c6b2e53",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/33dedfe4fd53ff009cc67ab36358d0624c6b2e53"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/c2d0d69edf01efbd6e87dfb250c373a32da957f8",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/c2d0d69edf01efbd6e87dfb250c373a32da957f8"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/15708",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15708"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/15711",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15711"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.5",
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qxrp-7cmp-p77h",
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-qxrp-7cmp-p77h"
        }
      ],
      "release_date": "2026-07-10T20:14:30.972000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-06T15:02:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:35939"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rabbitmq-server: RabbitMQ: Information Disclosure via Cross-Site Scripting in Federation Management"
    },
    {
      "cve": "CVE-2026-57214",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-07-10T21:01:30.238454+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499213"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ, a messaging and streaming broker. The RabbitMQ management user interface (UI) improperly handles the x-internal-purpose argument when rendering queue or exchange details. This vulnerability allows a user with permissions to declare a queue or exchange to inject and execute arbitrary JavaScript code in another user\u0027s browser, leading to a Cross-site Scripting (XSS) attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "RabbitMQ: RabbitMQ: Cross-site Scripting in management UI allows arbitrary JavaScript execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57214"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499213",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499213"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57214",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57214"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57214",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57214"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/b0027b6c1ae5b869d876e211efe6189ffd92b5c2",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/b0027b6c1ae5b869d876e211efe6189ffd92b5c2"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/b267a290dd89e42c6e0256f46fc273a8adb7f3ec",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/b267a290dd89e42c6e0256f46fc273a8adb7f3ec"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/15606",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15606"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/15608",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15608"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.5",
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6jfq-prw2-7rwp",
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6jfq-prw2-7rwp"
        }
      ],
      "release_date": "2026-07-10T20:18:15.810000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-06T15:02:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:35939"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "RabbitMQ: RabbitMQ: Cross-site Scripting in management UI allows arbitrary JavaScript execution"
    },
    {
      "cve": "CVE-2026-57215",
      "cwe": {
        "id": "CWE-459",
        "name": "Incomplete Cleanup"
      },
      "discovery_date": "2026-07-10T21:00:59.971208+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499204"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ, a messaging and streaming broker. This vulnerability allows an attacker to establish persistent foreign bindings to reply-to destinations. This occurs because temporary queues are not properly removed, leaving behind active routing entries. This can lead to unauthorized message routing and potential exposure of sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "RabbitMQ: RabbitMQ: Persistent foreign bindings allow unauthorized message routing",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57215"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499204",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499204"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57215",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57215"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57215",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57215"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/9055500d10ca7629dd2b051c6dc7a4b0bb8f6734",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/9055500d10ca7629dd2b051c6dc7a4b0bb8f6734"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/c84f3c880e0f22b49c01237cf8f86e176eeadc72",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/c84f3c880e0f22b49c01237cf8f86e176eeadc72"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/15935",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15935"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/15938",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15938"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3",
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-5cq3-v9jx-p3x3"
        }
      ],
      "release_date": "2026-07-10T20:23:26.132000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-06T15:02:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:35939"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "RabbitMQ: RabbitMQ: Persistent foreign bindings allow unauthorized message routing"
    },
    {
      "cve": "CVE-2026-57217",
      "cwe": {
        "id": "CWE-280",
        "name": "Improper Handling of Insufficient Permissions or Privileges"
      },
      "discovery_date": "2026-07-10T21:01:20.110997+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499210"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ, a messaging and streaming broker. During metadata-store failures, the topic authorization mechanism can incorrectly allow restricted topic writes and binds. This occurs because permission lookup errors from Khepri are treated as an \u0027allow\u0027 condition by the internal backend. This vulnerability could enable an attacker to bypass intended topic restrictions, potentially leading to unauthorized message manipulation or access.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rabbitmq: RabbitMQ: Authorization bypass allows unauthorized topic writes and binds during metadata-store failures",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57217"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499210",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499210"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57217",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57217"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57217",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57217"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/94f1d33a70fcfa09006649599e79fc92786a2d36",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/94f1d33a70fcfa09006649599e79fc92786a2d36"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/ce1f682aa6b398820c5e3ce1ff7435184027c82c",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/ce1f682aa6b398820c5e3ce1ff7435184027c82c"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/15941",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15941"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/15943",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/15943"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gpvw-75h5-3wvx",
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gpvw-75h5-3wvx"
        }
      ],
      "release_date": "2026-07-10T20:25:29.498000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-06T15:02:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:35939"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rabbitmq: RabbitMQ: Authorization bypass allows unauthorized topic writes and binds during metadata-store failures"
    },
    {
      "cve": "CVE-2026-57218",
      "cwe": {
        "id": "CWE-1220",
        "name": "Insufficient Granularity of Access Control"
      },
      "discovery_date": "2026-07-10T21:01:26.963199+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499212"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ. An existing consumer in RabbitMQ AMQP 0-9-1 can continue to receive messages even after its OAuth token has expired or its connection\u0027s scopes have been reduced. This occurs because consumers are not properly canceled or reauthorized when the channel user state changes, potentially leading to unauthorized information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rabbitmq-server: RabbitMQ: Information disclosure due to improper consumer reauthorization",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57218"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499212",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499212"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57218",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57218"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57218",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57218"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/501ad947cd6bbcc9486fe96e0d073992bfe52cc4",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/501ad947cd6bbcc9486fe96e0d073992bfe52cc4"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/db20d6c0fcf3056030f244b5adab0d45c0db0c9e",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/db20d6c0fcf3056030f244b5adab0d45c0db0c9e"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/16092",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16092"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/16097",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16097"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wmrr-4h5v-5ch7",
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wmrr-4h5v-5ch7"
        }
      ],
      "release_date": "2026-07-10T20:21:30.331000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-06T15:02:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:35939"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rabbitmq-server: RabbitMQ: Information disclosure due to improper consumer reauthorization"
    },
    {
      "cve": "CVE-2026-57219",
      "cwe": {
        "id": "CWE-477",
        "name": "Use of Obsolete Function"
      },
      "discovery_date": "2026-07-10T21:01:10.355040+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499207"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ, a messaging and streaming broker. An unauthenticated remote attacker could exploit an obsolete API endpoint (GET /api/auth) to disclose the OAuth 2 client secret. This vulnerability occurs when the RabbitMQ management plugin and OAuth configuration are enabled, leading to unauthorized access to sensitive credentials.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "RabbitMQ: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57219"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499207",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499207"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57219",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57219"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57219",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57219"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/98b1daf740237c85941e8addcbea6e74f4a2743c"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/aa387c4451e7b674df3e3ba89df86a99d697cc7f"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/16083",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16083"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/16086",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16086"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q",
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-pj24-8j6m-vq9q"
        }
      ],
      "release_date": "2026-07-10T20:22:26.516000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-06T15:02:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:35939"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "RabbitMQ: RabbitMQ: OAuth 2 client secret disclosure via obsolete API endpoint"
    },
    {
      "cve": "CVE-2026-57220",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-10T21:00:56.008543+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499203"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ. The stream listener in RabbitMQ does not properly enforce frame-size limits during authentication and before negotiation. This allows an unauthenticated remote client to send oversized stream frames, which can consume excessive broker memory. This can lead to a denial of service (DoS) condition, making the service unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rabbitmq-server: RabbitMQ: Denial of Service via oversized stream frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57220"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499203",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499203"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57220",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57220"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57220",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57220"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/595ec28fa1621b1f2c28124e4e0466a8ad963547",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/595ec28fa1621b1f2c28124e4e0466a8ad963547"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/773a49c4921e8be990262a2d609c35916825679e",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/773a49c4921e8be990262a2d609c35916825679e"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/16171",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16171"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/16173",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16173"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f364-87q5-j35q",
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f364-87q5-j35q"
        }
      ],
      "release_date": "2026-07-10T20:19:23.162000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-06T15:02:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:35939"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rabbitmq-server: RabbitMQ: Denial of Service via oversized stream frames"
    },
    {
      "cve": "CVE-2026-57221",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request (\u0027Forced Browsing\u0027)"
      },
      "discovery_date": "2026-07-10T21:01:07.009031+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499206"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in RabbitMQ. This vulnerability allows an authenticated user, with the ability to connect to a virtual host, to bypass authorization checks during passive queue.declare and exchange.declare AMQP 0-9-1 (Advanced Message Queuing Protocol) operations. This bypass enables the user to enumerate queue and exchange names, and read queue message and consumer counts, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "RabbitMQ: RabbitMQ: Information disclosure via authorization bypass in AMQP 0-9-1 operations",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
          "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-57221"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499206",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499206"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-57221",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-57221"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57221",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57221"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/709a14e49e06c138a8cd672c9809ca34a2767962",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/709a14e49e06c138a8cd672c9809ca34a2767962"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/commit/dc3d1aa4f5c3331a425ee599b45be9423a2e83fc",
          "url": "https://github.com/rabbitmq/rabbitmq-server/commit/dc3d1aa4f5c3331a425ee599b45be9423a2e83fc"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/16085",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16085"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/pull/16090",
          "url": "https://github.com/rabbitmq/rabbitmq-server/pull/16090"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9q2j-2hq8-22r2",
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9q2j-2hq8-22r2"
        }
      ],
      "release_date": "2026-07-10T20:24:27.921000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-06T15:02:20+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:35939"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:rabbitmq-server4-3-main@aarch64",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@src",
            "Red Hat Hardened Images:rabbitmq-server4-3-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "RabbitMQ: RabbitMQ: Information disclosure via authorization bypass in AMQP 0-9-1 operations"
    }
  ]
}