CVE-2015-8786

Vulnerability

The RabbitMQ Management plugin before version 3.6.1 does not validate the lengths_age and lengths_incr query parameters. Remote authenticated users with certain privileges can supply excessively large values for these parameters, leading to resource consumption. Affected versions include all RabbitMQ releases prior to 3.6.1 [1]. Red Hat distributions (OpenStack 5 and 7) shipped with vulnerable versions [3][4].

Exploitation

An attacker must have valid credentials and the necessary privileges to access the management plugin's HTTP API. By crafting requests with large numeric values for lengths_age or lengths_incr, the attacker can trigger excessive resource allocation on the server. No additional user interaction is required beyond the authenticated request [2].

Impact

Successful exploitation results in a denial of service (DoS) due to resource exhaustion. The server may become unresponsive or crash, disrupting messaging operations. The vulnerability does not lead to data disclosure or privilege escalation; the impact is limited to availability [3][4].

Mitigation

The fix was released in RabbitMQ version 3.6.1 [1]. Users should upgrade to 3.6.1 or later. For Red Hat OpenStack deployments, updated packages (rabbitmq-server-3.3.5-31.el7ost) are available via RHSA-2017-0530 and RHSA-2017-0532 [3][4]. No workarounds are documented; upgrading is the recommended mitigation.