Apache RocketMQ vulnerabilities

Latest Apache RocketMQ CVEs

Newest publication first

1. CVE-2023-37582 Apache RocketMQ: Possible remote code execution when using the update configuration function

   Published 2023-07-12

   Critical·CVSS 9.8

   The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerabil...

2. CVE-2023-33246 Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

   Published 2023-05-24

   Critical·CVSS 9.8 EPSS 96.6% CISA KEV added 2023-09-06 Exploited in the wild Framework module Public exploit PoC

   For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vu...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.