{"id":"CVE-2019-11287","aliases":["GHSA-hrfh-7j5f-8ccr"],"url":"https://o3.security/vulnerability/CVE-2019-11287","summary":"Pivotal RabbitMQ is vulnerable to a denial of service attack","details":"Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The \"X-Reason\" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.","published":"2019-11-23T00:15:10.683Z","modified":"2026-07-08T05:54:47.476396769Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Hex","name":"RabbitMQ","fixedVersion":"3.7.21"},{"ecosystem":"Hex","name":"RabbitMQ","fixedVersion":"3.8.1"},{"ecosystem":"Hex","name":"RabbitMQ","fixedVersion":"1.16.7"},{"ecosystem":"Hex","name":"RabbitMQ","fixedVersion":"1.17.4"}],"fix":null,"references":[{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2020:0078"},{"type":"ADVISORY","url":"https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html"},{"type":"ADVISORY","url":"https://pivotal.io/security/cve-2019-11287"},{"type":"EVIDENCE","url":"https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:54:47.476396769Z"}}