Security readout for executives and security teams
Plain-English summary
This flaw can crash RabbitMQ when its web management plugin processes a specially crafted HTTP header. It affects older RabbitMQ and RabbitMQ for Pivotal Platform releases. The business risk is service interruption to messaging workloads, not data theft or tampering based on the supplied sources.
Executive priority
Prioritize remediation for RabbitMQ systems supporting critical business workflows or exposed management interfaces. This is not presented as a data breach vulnerability, but a crash in messaging infrastructure can disrupt dependent applications and operations.
Technical view
CVE-2019-11287 is a CWE-400 resource consumption issue in the RabbitMQ web management plugin. The X-Reason HTTP header can carry an Erlang format string that expands heap usage and crashes the server. Affected versions are RabbitMQ 3.7.x before 3.7.21, 3.8.x before 3.8.1, and specified Pivotal Platform lines.
Likely exposure
Exposure is most likely where the RabbitMQ management plugin is enabled and reachable by users with the privileges and interaction conditions reflected in CVSS. Public internet exposure would increase operational risk, but the provided sources do not prove common external exposure.
Exploitation context
The bundle does not show CISA KEV listing or cited active exploitation. A public disclosure reference exists, so defenders should assume technical details are available, but avoid treating this as confirmed in-the-wild exploitation without further evidence.
Researcher notes
The CVSS vector is 4.5 with network attack vector, low complexity, high privileges, user interaction required, and high availability impact only. Evidence is strongest for affected versions and fixed releases; exploitation prevalence is not established in the supplied bundle.
Mitigation direction
- Upgrade RabbitMQ 3.7.x to 3.7.21 or later.
- Upgrade RabbitMQ 3.8.x to 3.8.1 or later.
- Upgrade RabbitMQ for Pivotal Platform 1.16.x to 1.16.7 or later.
- Upgrade RabbitMQ for Pivotal Platform 1.17.x to 1.17.4 or later.
- Apply relevant Fedora, Red Hat, or Debian package security updates where used.
- Restrict management plugin access to trusted administrators while upgrade work is completed.
Validation and detection
- Inventory RabbitMQ and RabbitMQ for Pivotal Platform versions across environments.
- Confirm whether the RabbitMQ web management plugin is enabled.
- Check whether management interfaces are reachable beyond trusted admin networks.
- Verify package versions against Pivotal, Fedora, Red Hat, or Debian advisories.
- Review monitoring for unexplained RabbitMQ crashes or memory exhaustion events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-400: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-11287 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.5 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H0.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
4.5MediumVector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://pivotal.io/security/cve-2019-11287CVE reference · x_refsource_CONFIRM
- FEDORA-2019-6497f51791CVE reference · vendor-advisory, x_refsource_FEDORA
- FEDORA-2019-74d2feb5beCVE reference · vendor-advisory, x_refsource_FEDORA
- RHSA-2020:0078CVE reference · vendor-advisory, x_refsource_REDHAT
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20PluginCVE reference · x_refsource_MISC
- [debian-lts-announce] 20210719 [SECURITY] [DLA 2710-1] rabbitmq-server security updateCVE reference · mailing-list, x_refsource_MLIST
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.