RabbitMQ 4.3.5

{
  "id": "73a73f8553877a8bd16fdb7abb51cd8f5558e1275797e92c12a7538dd756f7b9",
  "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "RabbitMQ 4.3.5",
    "summary": "RabbitMQ 4.3.5 includes a security-relevant management setting that can omit the Allow header from most HTTP responses to avoid disclosing supported HTTP methods. The release also adds management credential encryption and tighter frame limits before stream authentication.",
    "evidence": "When management.http.hide_allow_header is set to true, the Allow HTTP response header is omitted from all responses except 405 Method Not Allowed ones, where it is required by the HTTP specification. This avoids disclosing the supported HTTP methods to clients.",
    "products": [
      {
        "name": {
          "value": "RabbitMQ",
          "evidence": "RabbitMQ 4.3.5"
        },
        "prerequisites": [
          {
            "value": "When management.http.hide_allow_header is set to true",
            "evidence": "When management.http.hide_allow_header is set to true, the Allow HTTP response header is omitted from all responses except 405 Method Not Allowed ones, where it is required by the HTTP specification."
          },
          {
            "value": "When management.credential_encryption_secret is configured",
            "evidence": "When management.credential_encryption_secret is configured, the management UI login endpoint (POST /api/login) returns client credentials encrypted using AES-256-GCM"
          }
        ],
        "fixed_versions": [
          {
            "value": "4.3.5",
            "evidence": "RabbitMQ 4.3.5"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-rabbitmq-rabbitmq-server",
  "document_id": 22400,
  "published_at": "2026-08-17T21:42:00+00:00"
}