CVE catalog

CVE-2021-22116

rabbitmq-server: CVE-2021-22116

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.39% · Oct 25, 2026

RabbitMQ all versions prior to 3.8.16 are prone to a denial of service vulnerability due to improper input validation in AMQP 1.0 client connection endpoint. A malicious user can exploit the vulnerability by sending malicious AMQP messages to the target RabbitMQ instance having the AMQP 1.0 plugin enabled.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrabbitmq-serversid4.3.6-1fixed
Debianrabbitmq-serverforky4.3.6-1fixed
Debianrabbitmq-servertrixie4.0.5-6+deb13u2fixed
Debianrabbitmq-serverbookworm3.10.8-1.1+deb12u1fixed
Debianrabbitmq-serverbookworm-security3.10.8-1.1+deb12u1fixed
Suseelixir115linux enterprise module for server applications 15 sp61.15.7-150300.7.5.1fixed
Suseerlang26linux enterprise module for server applications 15 sp626.2.1-150300.7.5.1fixed
Suserabbitmq-server313linux enterprise module for server applications 15 sp63.13.1-150600.13.5.3fixed
Opensuseelixir115leap 15.61.15.7-150300.7.5.1fixed
Opensuseerlang26leap 15.626.2.1-150300.7.5.1fixed
Opensuserabbitmq-server313leap 15.63.13.1-150600.13.5.3fixed
Opensuserabbitmq-serverleap 15.33.8.11-3.3.3fixed
Suserabbitmq-serverlinux enterprise module for server applications 15 sp33.8.11-3.3.3fixed
Ubunturabbitmq-serverpro3.5.4-1vulnerable
Ubunturabbitmq-serverpro3.5.4-3vulnerable
Ubunturabbitmq-serverpro3.5.4-3.1vulnerable
Ubunturabbitmq-serverpro3.5.7-1vulnerable
Ubunturabbitmq-serverpro3.5.7-1ubuntu0.16.04.1vulnerable
Ubunturabbitmq-serverpro3.5.7-1ubuntu0.16.04.2vulnerable
Ubunturabbitmq-serverpro3.5.7-1ubuntu0.16.04.4vulnerable
Ubunturabbitmq-serverpro3.5.7-1ubuntu0.16.04.4+esm1fixed
Ubunturabbitmq-server18.043.6.10-1vulnerable
Ubunturabbitmq-server18.043.6.10-1ubuntu0.1vulnerable
Ubunturabbitmq-server18.043.6.10-1ubuntu0.3vulnerable
Ubunturabbitmq-server18.043.6.10-1ubuntu0.4vulnerable
Ubunturabbitmq-server18.043.6.10-1ubuntu0.5fixed
Ubunturabbitmq-server20.043.7.8-4ubuntu2vulnerable
Ubunturabbitmq-server20.043.7.18-1vulnerable
Ubunturabbitmq-server20.043.8.2-0ubuntu1vulnerable
Ubunturabbitmq-server20.043.8.2-0ubuntu1.1vulnerable
Ubunturabbitmq-server20.043.8.2-0ubuntu1.2vulnerable
Ubunturabbitmq-server20.043.8.2-0ubuntu1.3fixed
Ubunturabbitmq-server22.043.8.9-3ubuntu1fixed
Suserabbitmq-serverlinux enterprise module for server applications 15 sp23.8.3-3.3.4fixed
Opensuserabbitmq-serverleap 15.23.8.3-lp152.2.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrabbitmq-serversourcesid3.9.4-1not yet assignedNot reported[989056]
Debianrabbitmq-serversourceforky3.9.4-1not yet assignedNot reported[989056]
Debianrabbitmq-serversourcetrixie3.9.4-1not yet assignedNot reported[989056]
Debianrabbitmq-serversourcebookworm3.9.4-1not yet assignedNot reported[989056]
Suseelixir115rpmlinux enterprise module for server applications 15 sp61.15.7-150300.7.5.1Not reportedSUSE-FU-2024:2078-1Not reported
Suseerlang26rpmlinux enterprise module for server applications 15 sp626.2.1-150300.7.5.1Not reportedSUSE-FU-2024:2078-1Not reported
Suserabbitmq-server313rpmlinux enterprise module for server applications 15 sp63.13.1-150600.13.5.3Not reportedSUSE-FU-2024:2078-1Not reported
Opensuseelixir115rpmleap 15.61.15.7-150300.7.5.1Not reportedSUSE-FU-2024:2078-1Not reported
Opensuseerlang26rpmleap 15.626.2.1-150300.7.5.1Not reportedSUSE-FU-2024:2078-1Not reported
Opensuserabbitmq-server313rpmleap 15.63.13.1-150600.13.5.3Not reportedSUSE-FU-2024:2078-1Not reported
Opensuserabbitmq-serverrpmleap 15.33.8.11-3.3.3Not reportedOPENSUSE-SU-2021:3325-1Not reported
Suserabbitmq-serverrpmlinux enterprise module for server applications 15 sp33.8.11-3.3.3Not reportedSUSE-SU-2021:3325-1Not reported
Ubunturabbitmq-serverdebpro3.5.7-1ubuntu0.16.04.4+esm1Not reportedUBUNTU-CVE-2021-22116Not reported
Ubunturabbitmq-serverdeb18.043.6.10-1ubuntu0.5Not reportedUBUNTU-CVE-2021-22116Not reported
Ubunturabbitmq-serverdeb20.043.8.2-0ubuntu1.3Not reportedUBUNTU-CVE-2021-22116Not reported
Ubunturabbitmq-serverdeb22.043.8.9-3ubuntu1Not reportedUBUNTU-CVE-2021-22116Not reported
Suserabbitmq-serverrpmlinux enterprise module for server applications 15 sp23.8.3-3.3.4Not reportedSUSE-SU-2021:3254-1Not reported
Opensuserabbitmq-serverrpmleap 15.23.8.3-lp152.2.3.1Not reportedOPENSUSE-SU-2021:1334-1Not reported

[Debian bug #989056]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [rabbitmq-server]Fixed
    Details (4)

    • 3.10.8-1.1+deb12u1 · all · bookworm

      Fixed · Fixed: 3.9.4-1

      dsa · rabbitmq-server · debian · bookworm; dsa · rabbitmq-server · debian · 12

    • 3.10.8-1.1+deb12u1 · all · bookworm

      Fixed · Fixed: 3.9.4-1

      dsa · rabbitmq-server · debian · bookworm; dsa · rabbitmq-server · debian · 12

    • 3.10.8-1.1+deb12u1 · all · bookworm-security

      Fixed · Fixed: 3.9.4-1

      dsa · rabbitmq-server · debian · bookworm; dsa · rabbitmq-server · debian · 12

    • 3.10.8-1.1+deb12u1 · all · bookworm-security

      Fixed · Fixed: 3.9.4-1

      dsa · rabbitmq-server · debian · bookworm; dsa · rabbitmq-server · debian · 12

[Debian 13 (Trixie)]

  • [rabbitmq-server]Fixed
    Details (2)

    • 4.0.5-6+deb13u2 · all · trixie

      Fixed · Fixed: 3.9.4-1

      dsa · rabbitmq-server · debian · 13

    • 4.0.5-6+deb13u2 · all · trixie

      Fixed · Fixed: 3.9.4-1

      dsa · rabbitmq-server · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]