# Broadcom Rabbitmq Server


- [CVE-2016-9877](https://insights.sbomify.com/CVE-2016-9877/): Auth bypass in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7 (critical 9.8)
- [CVE-2026-67404](https://insights.sbomify.com/CVE-2026-67404/): RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch (critical 9.2)
- [CVE-2026-67231](https://insights.sbomify.com/CVE-2026-67231/): RabbitMQ: Trust-store whitelist by Issuer+Serial only (critical 9.1)
- [CVE-2026-57219](https://insights.sbomify.com/CVE-2026-57219/): Information disclosure in rabbitmq-server (high 8.7)
- [CVE-2026-67236](https://insights.sbomify.com/CVE-2026-67236/): RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login (high 8.2)
- [CVE-2026-67409](https://insights.sbomify.com/CVE-2026-67409/): RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (high 8.2)
- [CVE-2026-67410](https://insights.sbomify.com/CVE-2026-67410/): RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (high 8.2)
- [CVE-2026-66079](https://insights.sbomify.com/CVE-2026-66079/): RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS (high 8.2)
- [CVE-2026-67232](https://insights.sbomify.com/CVE-2026-67232/): RabbitMQ: Web-MQTT decompression bomb (high 8.2)
- [CVE-2021-22117](https://insights.sbomify.com/CVE-2021-22117/): Privilege escalation in RabbitMQ (high 7.8)
- [CVE-2017-4966](https://insights.sbomify.com/CVE-2017-4966/): Information disclosure in Pivotal RabbitMQ (high 7.8)
- [CVE-2026-67239](https://insights.sbomify.com/CVE-2026-67239/): RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI (high 7.6)

---
From sbomify Insights: https://insights.sbomify.com/products/broadcom/rabbitmq-server/