[AutoPR- Security] Patch rabbitmq-server for CVE-2026-57221, CVE-2026-57220, CVE-2026-57219, CVE-2026-57218, CVE-2026-57217, CVE-2026-57215, CVE-2026-57214, CVE-2026-57213, CVE-2026-57212, CVE-2026-57211, CVE-2026-57216 [HIGH]

SPECS/rabbitmq-server/CVE-2026-57211.patch

@@ -0,0 +1,81 @@
+From 63e00787c762998eaa5d760923c435e49ce6af46 Mon Sep 17 00:00:00 2001
+From: Michael Klishin <michaelklishin@icloud.com>
+Date: Mon, 23 Mar 2026 10:49:03 -0700
+Subject: [PATCH] Merge pull request #15804 from
+ rabbitmq/mergify/bp/v4.3.x/pr-15803
+
+Management plugin: apply path filtering earlier (backport #15803)
+
+(cherry picked from commit d157b663fa4eff8b85bf7802b3b631a624a9a30e)
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/rabbitmq/rabbitmq-server/commit/6730797f6a34b4e8308cea60adf1243857e70204.patch
+---
+ .../src/rabbit_mgmt_wm_static.erl             | 47 ++++++++++++++++---
+ 1 file changed, 40 insertions(+), 7 deletions(-)
+
+diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_wm_static.erl b/deps/rabbitmq_management/src/rabbit_mgmt_wm_static.erl
+index 12ebf4b..b1b7fd9 100644
+--- a/deps/rabbitmq_management/src/rabbit_mgmt_wm_static.erl
++++ b/deps/rabbitmq_management/src/rabbit_mgmt_wm_static.erl
+@@ -31,18 +31,51 @@ init(Req0, [{App, Path}]) ->
+ init(Req0, [{App, Path}|Tail]) ->
+     Req1 = rabbit_mgmt_headers:set_common_permission_headers(Req0, ?MODULE),
+     PathInfo = cowboy_req:path_info(Req1),
+-    Filepath = filename:join([code:priv_dir(App), Path|PathInfo]),
+-    %% We use erl_prim_loader because the file may be inside an .ez archive.
+-    FileInfo = erl_prim_loader:read_file_info(binary_to_list(Filepath)),
+-    case FileInfo of
+-        {ok, #file_info{type = regular}} -> do_init(Req1, App, Path);
+-        {ok, #file_info{type = symlink}} -> do_init(Req1, App, Path);
+-        _                                -> init(Req0, Tail)
++    case validate_path_info(PathInfo) of
++        ok ->
++            Filepath = filename:join([code:priv_dir(App), Path|PathInfo]),
++            %% We use `erl_prim_loader` because the file may be inside
++            %% an .ez archive.
++            FileInfo = erl_prim_loader:read_file_info(
++                         binary_to_list(Filepath)),
++            case FileInfo of
++                {ok, #file_info{type = regular}} ->
++                    do_init(Req1, App, Path);
++                {ok, #file_info{type = symlink}} ->
++                    do_init(Req1, App, Path);
++                _ ->
++                    init(Req0, Tail)
++            end;
++        error ->
++            init(Req0, Tail)
+     end.
+
+ do_init(Req, App, Path) ->
+     cowboy_static:init(Req, {priv_dir, App, Path}).
+
++%% Must be done here before `erl_prim_loader:read_file_info/1`
++%% is used.
++%%
++%% This mirrors the validation that `cowboy_static` performs internally
++%% except that this validation must happen before the one in Cowboy.
++validate_path_info([]) ->
++    ok;
++validate_path_info([<<".">>|_]) ->
++    error;
++validate_path_info([<<"..">>|_]) ->
++    error;
++validate_path_info([Segment|Tail]) ->
++    case validate_segment(Segment) of
++        ok    -> validate_path_info(Tail);
++        error -> error
++    end.
++
++validate_segment(Segment) ->
++    case binary:match(Segment, [<<$/>>, <<$\\>>, <<0>>]) of
++        nomatch -> ok;
++        _       -> error
++    end.
++
+ malformed_request(Req, State) ->
+     cowboy_static:malformed_request(Req, State).
+
+-- 
+2.45.4
+

SPECS/rabbitmq-server/CVE-2026-57212.patch

@@ -0,0 +1,78 @@
+From 38424a9a6ff0362f4c46620486f0847814b16ceb Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Wed, 15 Jul 2026 16:57:45 +0000
+Subject: [PATCH] HTTP API: refactor read_complete_body/1
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/rabbitmq/rabbitmq-server/commit/b8fc2ef7c50a2797d15e1ea7cf34f290032303bb.patch
+---
+ .../src/rabbit_mgmt_util.erl                  | 46 +++++++++++++------
+ 1 file changed, 33 insertions(+), 13 deletions(-)
+
+diff --git a/deps/rabbitmq_management/src/rabbit_mgmt_util.erl b/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
+index 9c4c65d..24694af 100644
+--- a/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
++++ b/deps/rabbitmq_management/src/rabbit_mgmt_util.erl
+@@ -716,8 +716,22 @@ read_complete_body(Req0, Acc, BodySizeLimit) ->
+             {error, "Exceeded HTTP request body size limit"};
+         false ->
+             case cowboy_req:read_body(Req0) of
+-                {ok, Data, Req}   -> {ok, <<Acc/binary, Data/binary>>, Req};
+-                {more, Data, Req} -> read_complete_body(Req, <<Acc/binary, Data/binary>>)
++                {ok, Data, Req} ->
++                    Total = <<Acc/binary, Data/binary>>,
++                    case byte_size(Total) > BodySizeLimit of
++                        true ->
++                            {error, http_body_limit_exceeded, BodySizeLimit, byte_size(Total)};
++                        false ->
++                            {ok, Total, Req}
++                    end;
++                {more, Data, Req} ->
++                    Total = <<Acc/binary, Data/binary>>,
++                    case byte_size(Total) > BodySizeLimit of
++                        true ->
++                            {error, http_body_limit_exceeded, BodySizeLimit, byte_size(Total)};
++                        false ->
++                            read_complete_body(Req, Total, BodySizeLimit)
++                    end
+             end
+     end.
+
+@@ -834,17 +848,23 @@ with_vhost_and_props(Fun, ReqData, Context) ->
+             not_found(rabbit_data_coercion:to_binary("vhost_not_found"),
+                       ReqData, Context);
+         VHost ->
+-            {ok, Body, ReqData1} = read_complete_body(ReqData),
+-            case decode(Body) of
+-                {ok, Props} ->
+-                    try
+-                        Fun(VHost, Props, ReqData1)
+-                    catch {error, Error} ->
+-                            bad_request(Error, ReqData1, Context)
+-                    end;
+-                {error, Reason} ->
+-                    bad_request(rabbit_mgmt_format:escape_html_tags(Reason),
+-                                ReqData1, Context)
++            case read_complete_body(ReqData) of
++                {error, http_body_limit_exceeded, LimitApplied, BytesRead} ->
++                    rabbit_log:warning(
++                      "HTTP API: request exceeded maximum allowed payload size (limit: ~tp bytes, payload size: ~tp bytes)",
++                      [LimitApplied, BytesRead]),
++                    bad_request("Exceeded HTTP request body size limit", ReqData, Context);
++                {ok, Body, ReqData1} ->
++                    case decode(Body) of
++                        {ok, Props} ->
++                            try
++                                Fun(VHost, Props, ReqData1)
++                            catch {error, Error} ->
++                                    bad_request(Error, ReqData1, Context)
++                            end;
++                        {error, Reason} ->
++			    bad_request(Reason, ReqData1, Context)
++                    end
+             end
+     end.
+
+-- 
+2.45.4
+

SPECS/rabbitmq-server/CVE-2026-57213.patch

@@ -0,0 +1,28 @@
+From 79a579397e4cc8c901f2680813d76eb77bb6074e Mon Sep 17 00:00:00 2001
+From: Michael Klishin <michaelklishin@icloud.com>
+Date: Wed, 11 Mar 2026 14:29:26 -0700
+Subject: [PATCH] Federation management: Use fmt_string/1 in one more place
+
+(cherry picked from commit c2d0d69edf01efbd6e87dfb250c373a32da957f8)
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/rabbitmq/rabbitmq-server/commit/33dedfe4fd53ff009cc67ab36358d0624c6b2e53.patch
+---
+ .../priv/www/js/tmpl/federation.ejs                             | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/deps/rabbitmq_federation_management/priv/www/js/tmpl/federation.ejs b/deps/rabbitmq_federation_management/priv/www/js/tmpl/federation.ejs
+index e47f697..06e3f62 100644
+--- a/deps/rabbitmq_federation_management/priv/www/js/tmpl/federation.ejs
++++ b/deps/rabbitmq_federation_management/priv/www/js/tmpl/federation.ejs
+@@ -82,7 +82,7 @@
+     </td>
+     <td><%= link.timestamp %></td>
+     <td><%= link.id %></td>
+-    <td><%= link.consumer_tag %></td>
++    <td><%= fmt_string(link.consumer_tag) %></td>
+     <td>
+         <form action="#/federation-restart-link" method="delete" class="confirm">
+         <input type="hidden" name="id" value="<%= link.id %>"/>
+-- 
+2.45.4
+

SPECS/rabbitmq-server/CVE-2026-57214.patch

@@ -0,0 +1,27 @@
+From d4255edcca60bb42dfbd1c85bec1e25006bd9b10 Mon Sep 17 00:00:00 2001
+From: Michael Klishin <michaelklishin@icloud.com>
+Date: Mon, 2 Mar 2026 09:32:07 -0800
+Subject: [PATCH] Escape x-internal-purpose used by the federation plugin
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/rabbitmq/rabbitmq-server/commit/b267a290dd89e42c6e0256f46fc273a8adb7f3ec.patch
+---
+ deps/rabbitmq_management/priv/www/js/formatters.js | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/deps/rabbitmq_management/priv/www/js/formatters.js b/deps/rabbitmq_management/priv/www/js/formatters.js
+index 317ecd8..f49746f 100644
+--- a/deps/rabbitmq_management/priv/www/js/formatters.js
++++ b/deps/rabbitmq_management/priv/www/js/formatters.js
+@@ -817,7 +817,7 @@ function _link_to(name, url, highlight, args) {
+     if (highlight == undefined) highlight = true;
+     var title = null;
+     if (args != undefined && args['x-internal-purpose'] != undefined) {
+-        var purpose = args['x-internal-purpose'];
++        var purpose = fmt_escape_html(args['x-internal-purpose']);
+         title = 'This is used internally by the ' + purpose + ' mechanism.';
+     }
+     return '<a href="' + url + '"' +
+-- 
+2.45.4
+

SPECS/rabbitmq-server/CVE-2026-57215.patch

@@ -0,0 +1,49 @@
+From f8f5f594a6d1e3c88ac4afc820ab1537b129d3e2 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Wed, 15 Jul 2026 16:57:13 +0000
+Subject: [PATCH] Reject bindings to Direct Reply-to virtual queues
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/rabbitmq/rabbitmq-server/commit/9055500d10ca7629dd2b051c6dc7a4b0bb8f6734.patch
+---
+ deps/rabbit/src/rabbit_channel.erl | 17 +++++++++++++++++
+ 1 file changed, 17 insertions(+)
+
+diff --git a/deps/rabbit/src/rabbit_channel.erl b/deps/rabbit/src/rabbit_channel.erl
+index f6b34ef..8297694 100644
+--- a/deps/rabbit/src/rabbit_channel.erl
++++ b/deps/rabbit/src/rabbit_channel.erl
+@@ -1119,6 +1119,22 @@ check_exchange_deletion(XName = #resource{name = <<"amq.", _/binary>>,
+ check_exchange_deletion(_) ->
+     ok.
+
++reject_volatile_queue_as_binding_target(queue, DestinationNameBin) ->
++    case DestinationNameBin of
++        <<"amq.rabbitmq.reply-to">> ->
++            rabbit_misc:protocol_error(
++              access_refused,
++              "cannot bind or unbind to a volatile (direct reply-to) queue", []);
++        <<"amq.rabbitmq.reply-to.", _/binary>> ->
++            rabbit_misc:protocol_error(
++              access_refused,
++              "cannot bind or unbind to a volatile (direct reply-to) queue", []);
++        _ ->
++            ok
++    end;
++reject_volatile_queue_as_binding_target(_, _) ->
++    ok.
++
+ %% check that an exchange/queue name does not contain the reserved
+ %% "amq."  prefix.
+ %%
+@@ -1881,6 +1897,7 @@ binding_action(Action, SourceNameBin0, DestinationType, DestinationNameBin0,
+                #user{username = Username} = User) ->
+     ExchangeNameBin = strip_cr_lf(SourceNameBin0),
+     DestinationNameBin = strip_cr_lf(DestinationNameBin0),
++    reject_volatile_queue_as_binding_target(DestinationType, DestinationNameBin),
+     DestinationName = name_to_resource(DestinationType, DestinationNameBin, VHostPath),
+     check_write_permitted(DestinationName, User, AuthzContext),
+     ExchangeName = rabbit_misc:r(VHostPath, exchange, ExchangeNameBin),
+-- 
+2.45.4
+

SPECS/rabbitmq-server/CVE-2026-57216.patch

@@ -0,0 +1,73 @@
+From 9f8c39fcf0acbc43080ee7017a62a02832114112 Mon Sep 17 00:00:00 2001
+From: Michael Klishin <michaelklishin@icloud.com>
+Date: Sun, 5 Apr 2026 15:59:06 -0700
+Subject: [PATCH 1/2] Use `peername/1` over `sockname/1` in a few places
+
+Upstream-reference: https://patch-diff.githubusercontent.com/raw/rabbitmq/rabbitmq-server/pull/15936.patch
+
+---
+ deps/rabbit/src/rabbit_reader.erl                 | 3 ++-
+ deps/rabbit_common/src/rabbit_net.erl             | 2 +-
+ deps/rabbitmq_stream/src/rabbit_stream_reader.erl | 5 +++--
+ 3 files changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/deps/rabbit/src/rabbit_reader.erl b/deps/rabbit/src/rabbit_reader.erl
+index f1603f1..65d9d4a 100644
+--- a/deps/rabbit/src/rabbit_reader.erl
++++ b/deps/rabbit/src/rabbit_reader.erl
+@@ -1496,6 +1496,7 @@ auth_phase(Response,
+                            #connection{protocol       = Protocol,
+                                        auth_mechanism = {Name, AuthMechanism},
+                                        auth_state     = AuthState,
++                                       peer_host      = PeerHost,
+                                        host           = RemoteAddress},
+                        sock = Sock}) ->
+     rabbit_log:debug("Client address during authN phase: ~tp", [RemoteAddress]),
+@@ -1517,7 +1518,7 @@ auth_phase(Response,
+                                     auth_state = AuthState1}};
+         {ok, User = #user{username = Username}} ->
+             rabbit_access_control:clear_max_heap_size(),
+-            case rabbit_access_control:check_user_loopback(Username, Sock) of
++            case rabbit_access_control:check_user_loopback(Username, PeerHost) of
+                 ok ->
+                     rabbit_core_metrics:auth_attempt_succeeded(RemoteAddress, Username, amqp091),
+                     notify_auth_result(Username, user_authentication_success,
+diff --git a/deps/rabbit_common/src/rabbit_net.erl b/deps/rabbit_common/src/rabbit_net.erl
+index 88ff58b..75a0cc4 100644
+--- a/deps/rabbit_common/src/rabbit_net.erl
++++ b/deps/rabbit_common/src/rabbit_net.erl
+@@ -305,7 +305,7 @@ sock_funs(inbound)  -> {fun peername/1, fun sockname/1};
+ sock_funs(outbound) -> {fun sockname/1, fun peername/1}.
+
+ is_loopback(Sock) when is_port(Sock) ; ?IS_SSL(Sock) ->
+-    case sockname(Sock) of
++    case peername(Sock) of
+         {ok, {Addr, _Port}} -> is_loopback(Addr);
+         {error, _}          -> false
+     end;
+diff --git a/deps/rabbitmq_stream/src/rabbit_stream_reader.erl b/deps/rabbitmq_stream/src/rabbit_stream_reader.erl
+index 785bb0a..aae5eda 100644
+--- a/deps/rabbitmq_stream/src/rabbit_stream_reader.erl
++++ b/deps/rabbitmq_stream/src/rabbit_stream_reader.erl
+@@ -1314,7 +1314,8 @@ handle_frame_pre_auth(Transport,
+ handle_frame_pre_auth(Transport,
+                       #stream_connection{socket = S,
+                                          authentication_state = AuthState0,
+-                                         host = Host} =
++                                         host = Host,
++                                         peer_host = PeerHost} =
+                           Connection0,
+                       State,
+                       {request, CorrelationId,
+@@ -1366,7 +1367,7 @@ handle_frame_pre_auth(Transport,
+                             rabbit_access_control:clear_max_heap_size(),
+                             case
+                                 rabbit_access_control:check_user_loopback(Username,
+-                                                                          S)
++                                                                          PeerHost)
+                             of
+                                 ok ->
+                                     rabbit_core_metrics:auth_attempt_succeeded(Host,
+-- 
+2.45.4
+