VersionDrift
Product

RabbitMQ

Messaging · products/rabbitmq.yaml · RSS

Latest 4.4.0 Oct 19, 2026

Latest per track

TrackLatestReleased
44.4.0Oct 19, 2026
33.13.7Aug 26, 2024

Lifecycle

BranchLatestReleasedEnd of life
4.34.3.7Apr 23, 2026— · maintained
4.24.2.9Oct 27, 2025Jul 31, 2026 · ended
4.14.1.8Apr 15, 2025Jan 30, 2026 · ended
4.04.0.9Sep 18, 2024Apr 15, 2025 · ended
3.133.13.7Feb 22, 2024Sep 17, 2024 · ended
3.123.12.14Jun 1, 2023Feb 21, 2024 · ended
3.113.11.28Sep 26, 2022Jun 1, 2023 · ended
3.103.10.25May 3, 2022Sep 28, 2022 · ended
3.93.9.29Jul 23, 2021Jan 31, 2023 · ended
3.83.8.35Oct 1, 2019Jul 31, 2022 · ended
3.73.7.28Nov 28, 2017Sep 30, 2020 · ended
3.63.6.16Dec 22, 2015May 31, 2018 · ended
3.53.5.8Mar 11, 2015Oct 31, 2016 · ended
3.43.4.4Oct 21, 2014Oct 31, 2015 · ended
3.33.3.5Apr 2, 2014Mar 31, 2015 · ended
3.23.2.4Oct 23, 2013Oct 31, 2014 · ended
3.13.1.5May 1, 2013Apr 30, 2014 · ended
3.03.0.4Nov 19, 2012Nov 30, 2013 · ended

Recent releases

4.4.0 Oct 19, 2026 Release notes ↗ 4breaking36feature
breakingThe following AMQP 0-9-1 headers are no longer parsed: x-amqp-1.0-properties x-amqp-1.0-app-properties x-amqp-1.0-message-annotations x-amqp-1.0-footer RabbitMQ 3.13 and earlier used them to carry the AMQP 1.0 sections of a message received over AMQP 1.0. Nothing has written them since 4.0, so…
breakingLikewise, the x-basic-delivery-mode, x-basic-priority and x-basic-expiration message annotations are no longer parsed. They were written before 4.0 when an AMQP 0-9-1 message was encoded as AMQP 1.0 for a stream, so only a stream entry written by a 3.13 or earlier node carries them, and reading it…
breakingOpenID Connect discovery responses are now validated more strictly. A deployment whose identity provider serves non-HTTPS (http://) endpoints, or whose issuer claim does not match the discovery endpoint used to retrieve it, will fail discovery validation after the upgrade. This is known to affect…
4.3.7 Oct 20, 2026 → 4.4.0 Release notes ↗ 20fix7feature
4.3.6 Sep 14, 2026 → 4.4.0 Release notes ↗ 3security22fix8feature
securityFixes GHSA-j6hc-926v-qwq2: RabbitMQ STOMP consumers retain OAuth queue access after JWT expiration
securityFixes GHSA-6jvc-jx8w-m757: RabbitMQ Stream Publisher Management API Discloses Unauthorized Vhost and Stream Existence
securityFixes GHSA-342v-cj47-c9g8: Cross-vhost Stream consumer virtual-host existence disclosure
4.3.5 Aug 17, 2026 → 4.4.0 Release notes ↗ 14security24fix10feature
securityFixes GHSA-cfqc-c682-93mm: RabbitMQ Web STOMP: compressed pre-authentication messages exhaust broker memory
securityFixes CVE-2026-67419: Consecutive topic wildcards cause combinatorial routing work
securityFixes GHSA-6xpg-rfmh-grhq: STOMP pre-authentication frame size limit is not enforced
4.3.4 Jul 23, 2026 → 4.4.0 Release notes ↗ 2security12fix1feature
securityFixes CVE-2026-67414: RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation
securityFixes CVE-2026-67416: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation
4.3.3 Jul 20, 2026 → 4.4.0 Release notes ↗ 14security21fix19feature
securityFixes CVE-2026-67409: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252)
securityFixes CVE-2026-67410: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200)
securityFixes CVE-2026-67408: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service
4.3.2 Jun 15, 2026 → 4.4.0 Release notes ↗ 3security15fix8feature
securityFixes CVE-2026-67237: Reflected XSS via the OAuth bootstrap JS endpoint
securityFixes CVE-2026-67234: Non-RFC-conformant cookie name when clearing the auth-mechanism preference
securityFixes CVE-2026-67236: Plaintext username:password stored in an insecure cookie after successful POST /login
4.3.1 May 20, 2026 → 4.4.0 Release notes ↗ 10security17fix13feature
securityFixes CVE-2026-67240: ReDoS via AMQP 1.0 SQL filter LIKE wildcard
securityFixes CVE-2026-67227: Atom exhaustion: to_atom on global-parameter :name
securityFixes CVE-2026-66072: Atom table exhaustion via stream `chunk_selector`
4.3.0 Apr 23, 2026 → 4.4.0 Release notes ↗ 5breaking30feature5deprecated
breakingcluster_partition_handling
breakingcluster_partition_handling.pause_if_all_down.recover
breakingcluster_partition_handling.pause_if_all_down.nodes.$name
4.2.9 Jul 20, 2026 → 4.4.0 Release notes ↗ 14security24fix15feature
securityFixes CVE-2026-67409: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS (CWE-252)
securityFixes CVE-2026-67410: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint (CWE-200)
securityFixes CVE-2026-67408: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service
4.2.8 Jun 15, 2026 → 4.4.0 Release notes ↗ 3security10fix7feature
securityFixes CVE-2026-67237: Reflected XSS via the OAuth bootstrap JS endpoint
securityFixes CVE-2026-67234: Non-RFC-conformant cookie name when clearing the auth-mechanism preference
securityFixes CVE-2026-67236: Plaintext username:password stored in an insecure cookie after successful POST /login
4.2.7 May 19, 2026 → 4.4.0 Release notes ↗ 7security11fix12feature
securityFixes CVE-2026-67240: ReDoS via AMQP 1.0 SQL filter LIKE wildcard
securityFixes CVE-2026-67226: Admin-only atom exhaustion: PUT /api/users tags list
securityFixes CVE-2026-67227: Atom exhaustion: to_atom on global-parameter :name
4.2.6 Apr 23, 2026 → 4.4.0 Release notes ↗ 35security22fix16feature
securityFixes CVE-2026-57219: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations
securityFixes CVE-2026-66079: Pre-auth AMQP 1.0 array32 zero-width element DoS
securityFixes CVE-2026-57220: Stream listener does not enforce configured frame-size limit during authentication, permitting unauth'd mem-exhaust DoS
4.2.5 Mar 17, 2026 → 4.4.0 Release notes ↗ 3security15fix5feature
securityFixes CVE-2026-57214: Stored XSS in RabbitMQ management UI
securityFixes CVE-2026-57212: RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size
securityFixes CVE-2026-57213: Stored XSS in RabbitMQ federation management plugin via unsanitized consumer_tag rendering
4.2.4 Feb 17, 2026 → 4.4.0 Release notes ↗ 1security10fix6feature
securityFixes CVE-2026-44838: RabbitMQ MQTT Topic Permission Authorization Bypass

Security advisories

4.9 GHSA-j6hc-926v-qwq2 RabbitMQ STOMP consumers retain OAuth queue access after JWT expiration
2.3 GHSA-6jvc-jx8w-m757 RabbitMQ Stream Publisher Management API Discloses Unauthorized Vhost and Stream Existence
2.3 GHSA-342v-cj47-c9g8 Cross-vhost Stream consumer virtual-host existence disclosure
6.0 GHSA-5jgm-jxp7-gwjh MQTT retained message store has no size or count limit and is never reclaimed
4.5 CVE-2026-67421 Stored HTML Injection in RabbitMQ Management OAuth Error Handling
6.0 GHSA-6gmw-wxch-cvvc Shovel URI credentials disclosed to read-only monitoring users via the shovel management HTTP API
2.3 GHSA-27gv-h5q6-cpwg RabbitMQ policymaker RCE through federation-management nonmember RPC and distribution reflection
5.9 GHSA-3526-xvv4-q9mr RabbitMQ administrator RCE through reflected Erlang distribution authentication
6.3 GHSA-6xpg-rfmh-grhq STOMP pre-authentication frame size limit is not enforced
2.3 GHSA-pj8f-mw2q-3xjj RabbitMQ consistent-hash exchange: empty array crashes DLX queue processes
2.3 GHSA-4826-gphh-vw3x MQTT 5.0: Receive Maximum zero disables delivery credit
6.0 GHSA-6chv-gv3h-cvcj RabbitMQ direct reply-to: forged suffix fanout causes quadratic mailbox memory
8.2 GHSA-cfqc-c682-93mm RabbitMQ Web STOMP: compressed pre-authentication messages exhaust broker memory
5.3 GHSA-6588-rqcr-59pw AMQP 1.0 post-body properties bypass user-ID validation and reach consumers
2.3 CVE-2026-67418 MQTT 5.0: inapplicable PUBLISH property disconnects matching subscribers
2.3 CVE-2026-67420 RabbitMQ OAuth credential refresh retains revoked runtime tags
7.1 CVE-2026-67419 Consecutive topic wildcards cause combinatorial routing work
5.3 CVE-2026-67416 AMQP 1.0 symbolic body descriptor prefix collisions bypass validation
6.0 CVE-2026-67414 RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation
5.9 CVE-2026-67415 Shovel Management Atom Exhaustion Allows Persistent Broker-Wide Denial of Service

Sources

See how far your stack has drifted from upstream. Release data from vendors’ own sources · feed under CC BY 4.0 · Code under AGPL-3.0 Settings Feed status