VYPR
← All advisories
High severityNVD Advisory· Published Nov 22, 2019· Updated Sep 16, 2024

RabbitMQ Web Management Plugin DoS via heap overflow

CVE-2019-11287

Description

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

RabbitMQ web management plugin crashes via malicious Erlang format string in X-Reason header, causing denial of service.

Vulnerability

Pivotal RabbitMQ versions 3.7.x prior to 3.7.21, 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform versions 1.16.x prior to 1.16.7 and 1.17.x prior to 1.17.4 contain a vulnerability in the web management plugin. The plugin does not properly sanitize the X-Reason HTTP header, allowing an attacker to inject a malicious Erlang format string. When processed, this string expands and consumes heap memory, causing the server to crash [1][3].

Exploitation

Exploitation requires valid credentials for the web management plugin (e.g., the default guest:guest account). The attacker initiates an AMQP connection, then uses the “Force Close” action on that connection while providing a crafted X-Reason header. A proof-of-concept payload, such as ~9000000000n, triggers a regex expansion that allocates a massive string, leading to heap exhaustion [3]. The vulnerability does not involve authentication bypass; the attacker must have legitimate access to the management interface.

Impact

Successful exploitation crashes both the RabbitMQ server (port 5672) and the web management plugin (port 15672), resulting in a denial of service. The crash is recorded in /var/log/rabbitmq/erl_crash.dump [3]. This can disrupt all messaging operations on the affected broker.

Mitigation

The vulnerability is patched in RabbitMQ 3.7.21 and 3.8.1, and in Pivotal Platform versions 1.16.7 and 1.17.4. Red Hat issued an update (RHSA-2020:0078) for affected OpenStack deployments [2]. Users should upgrade to these fixed versions. Restricting access to the management plugin can reduce the attack surface, but patching is the recommended remediation.

References
  1. NVD - CVE-2019-11287
  2. https://access.redhat.com/errata/RHSA-2020:0078
  3. Disclosures/CVE-2019-11287-DoS via Heap Overflow-RabbitMQ Web Management Plugin at master · DrunkenShells/Disclosures

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
RabbitMQHex
>= 3.7.0, < 3.7.213.7.21
RabbitMQHex
>= 3.8.0, < 3.8.13.8.1
RabbitMQHex
< 1.16.71.16.7
RabbitMQHex
>= 1.17.0, < 1.17.41.17.4

Affected products

54

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

10

News mentions

0

No linked articles in our index yet.