CVE-2019-11287 RabbitMQ Web Management Plugin DoS via heap overflow
An attacker can crash the RabbitMQ server by sending a malicious HTTP header to the web management plugin, causing a heap overflow.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-11287?
CVE-2019-11287 is a medium-severity denial of service vulnerability in Broadcom Rabbitmq Server, published on 22 Nov 2019. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
Which versions are affected by CVE-2019-11287?
8 open source packages ship an affected version, including RabbitMQ. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
RabbitMQ Hex | All versions | 1.16.7 |
RabbitMQ Hex | All versions | 1.16.7 |
RabbitMQ Hex | From 1.17.0 | 1.17.4 |
RabbitMQ Hex | From 1.17.0 | 1.17.4 |
RabbitMQ Hex | From 3.7.0 | 3.7.21 |
RabbitMQ Hex | From 3.7.0 | 3.7.21 |
2 more packages
RabbitMQ Hex | From 3.8.0 | 3.8.1 |
RabbitMQ Hex | From 3.8.0 | 3.8.1 |
Products include Broadcom Rabbitmq Server, Debian Debian Linux, Fedoraproject Fedora, Pivotal Software Rabbitmq, Redhat Openstack.
How do I fix CVE-2019-11287?
Upgrade RabbitMQ to a fixed version for your release line: 1.16.7, 1.17.4, 3.7.21 or 3.8.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-11287 being exploited?
There is no known exploitation of CVE-2019-11287 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Broadcom Rabbitmq Server
- CVE-2016-9877 Auth bypass in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7
- CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
- CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only
- CVE-2026-57219 Information disclosure in rabbitmq-server
- CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
Sources
Also known as DEBIAN-CVE-2019-11287, GHSA-hrfh-7j5f-8ccr, UBUNTU-CVE-2019-11287.