How many CVEs have a located fix in rabbitmq/rabbitmq-server?

39 published CVEs have a fix traced to functions in rabbitmq/rabbitmq-server, touching 103 functions across 61 files.

Which function in rabbitmq/rabbitmq-server has been patched by the most CVEs?

dispatcher in deps/rabbitmq_management/src/rabbit_mgmt_dispatcher.erl has been changed by 4 CVE fixes, from 2026 to 2026.

How large is a typical CVE fix in rabbitmq/rabbitmq-server?

The median fix changes 50 lines. 36% of fixes change 20 lines or fewer, and 31% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

erlang

javascript

#110 of 500 repositories

rabbitmq/rabbitmq-server

Name: rabbitmq/rabbitmq-server: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix October 14, 2026

39

CVE fixes located

Published CVEs

103

Functions patched

Distinct function sites

61

Files patched

Distinct source files

2020–2026

Years covered

By CVE publication date

Overview

39 published CVEs have a fix traced to functions in rabbitmq/rabbitmq-server, the earliest published in 2020. Those fixes changed 103 distinct functions across 61 files, in 535 patch hunks.

Among the 500 repositories tracked here, rabbitmq/rabbitmq-server ranks #110 by the number of CVEs with a located fix.

Most patched functions

Functions in rabbitmq/rabbitmq-server changed by the most CVE fixes.

Most patched files

Files in rabbitmq/rabbitmq-server changed by the most CVE fixes.

1deps/rabbitmq_management/src/rabbit_mgmt_dispatcher.erl5 CVEs · 3 functions
2deps/rabbitmq_management/priv/www/js/dispatcher.js4 CVEs · 0 functions
3deps/rabbitmq_auth_backend_oauth2/src/rabbit_auth_backend_oauth2.erl3 CVEs · 5 functions
4deps/rabbitmq_management/priv/www/js/main.js3 CVEs · 5 functions
5deps/rabbit/src/rabbit_channel.erl3 CVEs · 5 functions
6deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl3 CVEs · 4 functions
7deps/rabbit/src/rabbit_reader.erl3 CVEs · 3 functions
8deps/rabbit/src/rabbit_amqp_management.erl3 CVEs · 1 functions
9deps/rabbitmq_management/src/rabbit_mgmt_wm_auth.erl2 CVEs · 5 functions
10deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl2 CVEs · 5 functions

Fix size

How much code a CVE fix in rabbitmq/rabbitmq-server changes, with backports counted once.

50

Median lines changed

Added plus removed, per CVE

36%

Fixes of 20 lines or fewer

Share of CVE fixes

31%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in rabbitmq/rabbitmq-server, and the functions each fix changed.

RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers
CVE-2026-67418parse_props is_definition_json_extension_required init
Medium · CVSS 5.3
EPSS 0.4%2026-10-14
RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation
CVE-2026-67414parse_array1 generate2
Medium · CVSS 6.0
EPSS 0.5%2026-10-14
RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation
CVE-2026-67416is_definition_json_extension_required init erlang_version
Medium · CVSS 5.3
EPSS 0.5%2026-10-14
RabbitMQ OAuth credential refresh retains revoked runtime tags
CVE-2026-67420update_state
Low · CVSS 2.3
EPSS 0.2%2026-09-25
RabbitMQ: Consecutive topic wildcards cause combinatorial routing work
CVE-2026-67419trie_match validate_binding info
High · CVSS 7.1
EPSS 0.3%2026-09-25
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling
CVE-2026-67421
Medium · CVSS 4.5
EPSS 0.3%2026-09-25
RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service
CVE-2026-67408bad_request dispatcher
High · CVSS 7.1
EPSS 0.4%2026-09-25
RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint
CVE-2026-67410adjust_client_secret map oidc_settings_from
High · CVSS 8.2
EPSS 0.4%2026-09-25
RabbitMQ: Atom exhaustion: to_atom on global-parameter :name
CVE-2026-67227name
Medium · CVSS 5.9
EPSS 0.3%2026-09-25
RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list
CVE-2026-67226validate_tag_count validate bad_request
Medium · CVSS 6.9
EPSS 0.4%2026-09-25
RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass
CVE-2026-67411send_fun
Medium · CVSS 6.0
EPSS 0.3%2026-09-25
RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression
CVE-2026-67413validate_binding check_fun
Medium · CVSS 6.0
EPSS 0.3%2026-09-25

Get an alert for each new rabbitmq/rabbitmq-server CVE, with the patched functions and AI-written analysis.

Monitor rabbitmq-server CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

Combodo/iTop39 CVEs debian/xorg-server39 CVEs facebook/hhvm39 CVEs givanz/Vvveb39 CVEs honojs/hono39 CVEs vercel/next.js39 CVEs apache/struts40 CVEs Exiv2/exiv240 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in rabbitmq/rabbitmq-server.

How many CVEs have a located fix in rabbitmq/rabbitmq-server?: 39 published CVEs have a fix traced to functions in rabbitmq/rabbitmq-server, touching 103 functions across 61 files.
Which function in rabbitmq/rabbitmq-server has been patched by the most CVEs?: dispatcher in deps/rabbitmq_management/src/rabbit_mgmt_dispatcher.erl has been changed by 4 CVE fixes, from 2026 to 2026.
How large is a typical CVE fix in rabbitmq/rabbitmq-server?: The median fix changes 50 lines. 36% of fixes change 20 lines or fewer, and 31% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track rabbitmq/rabbitmq-server CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing