<div class="container">
<h1>Security update for rabbitmq-server</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:20126-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-01-22T13:47:27Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1246091">bsc#1246091</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-30219.html">CVE-2025-30219</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-30219</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.7</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-30219</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.1</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-30219</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.1</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:L</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server 16.0</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 16.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves one vulnerability can now be installed.</p>
<h2>Description:</h2>
<p>This update for rabbitmq-server fixes the following issues:</p>
<p>Changes in rabbitmq-server:</p>
<p>Update to 4.1.5:</p>
<ul>
<li>
<p>Highlights</p>
</li>
<li>
<p>Khepri, an alternative schema data store developed to replace Mnesia,
has matured and is now fully supported (it previously was an experimental feature)</p>
</li>
<li>AMQP 1.0 is now a core protocol that is always enabled. Its plugin is now a no-op that only exists to simplify upgrades.</li>
<li>The AMQP 1.0 implementation is now significantly more efficient: its peak throughput is more than double than that of 3.13.x
on some workloads</li>
<li>Efficient sub-linear quorum queue recovery on node startup using checkpoints</li>
<li>Quorum queues now support priorities (but not exactly the same way as classic queues)</li>
<li>AMQP 1.0 clients now can manage topologies similarly to how AMQP 0-9-1 clients do it</li>
<li>The AMQP 1.0 convention (address format) used for interacting with with AMQP 0-9-1 entities is now easier to reason about</li>
<li>Mirroring (replication) of classic queues was removed after several years of deprecation. For replicated messaging data types,
use quorum queues and/or streams. Non-replicated classic queues remain and their development continues</li>
<li>Classic queue storage efficiency improvements, in particular recovery time and storage of multi-MiB messages</li>
<li>Nodes with multiple enabled plugins and little on disk data to recover now start up to 20-30% faster</li>
<li>New exchange type: Local Random Exchange</li>
<li>Quorum queue log reads are now offloaded to channels (sessions, connections).</li>
<li>Initial Support for AMQP 1.0 Filter Expressions</li>
<li>Feature Flags Quality of Life Improvements</li>
<li>
<p>rabbitmqadmin v2</p>
</li>
<li>
<p>Breaking Changes</p>
</li>
<li>
<p>Before a client connection can negotiate a maximum frame size (frame_max), it must authenticate
successfully. Before the authenticated phase, a special lower frame_max value
is used.</p>
</li>
<li>With this release, the value was increased from the original 4096 bytes to 8192
to accommodate larger JWT tokens.</li>
<li>amqplib is a popular client library that has been using
a low frame_max default of 4096. Its users must upgrade to a compatible version
(starting with 0.10.7) or explicitly use a higher frame_max.
amqplib versions older than 0.10.7 will not be able to connect to
RabbitMQ 4.1.0 and later versions due to the initial AMQP 0-9-1 maximum frame size
increase covered above.</li>
<li>The default MQTT Maximum Packet Size changed from 256 MiB to 16 MiB.</li>
<li>
<p>The following rabbitmq.conf settings are unsupported:</p>
<ul>
<li>cluster_formation.etcd.ssl_options.fail_if_no_peer_cert</li>
<li>cluster_formation.etcd.ssl_options.dh</li>
<li>cluster_formation.etcd.ssl_options.dhfile</li>
</ul>
</li>
<li>
<p>Classic Queues is Now a Non-Replicated Queue Type</p>
</li>
<li>Quorum Queues Now Have a Default Redelivery Limit</li>
<li>Up to RabbitMQ 3.13, when an AMQP 0.9.1 client (re-)published a message to RabbitMQ, RabbitMQ interpreted the</li>
<li>AMQP 0.9.1 x-death header in the published message's basic_message.content.properties.headers field.</li>
<li>RabbitMQ 4.x will not interpret this x-death header anymore when clients (re-)publish a message.</li>
<li>CQv1 Storage Implementation was Removed</li>
<li>Settings cluster_formation.randomized_startup_delay_range.* were Removed</li>
<li>Several Disk I/O-Related Metrics were Removed</li>
<li>Default Maximum Message Size Reduced to 16 MiB</li>
<li>RabbitMQ 3.13 rabbitmq.conf setting rabbitmq_amqp1_0.default_vhost is unsupported in RabbitMQ 4.0.</li>
<li>RabbitMQ 3.13 rabbitmq.conf settings mqtt.default_user, mqtt.default_password,
and amqp1_0.default_user are unsupported in RabbitMQ 4.0.</li>
<li>Starting with Erlang 26, client side TLS peer certificate chain verification settings are enabled by default in most contexts:
from federation links to shovels to TLS-enabled LDAP client connections.</li>
<li>
<p>RabbitMQ Shovels will be able connect to a RabbitMQ 4.0 node via AMQP 1.0 only when the Shovel runs on a RabbitMQ node >= 3.13.7.</p>
<ul>
<li>See https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.0.1</li>
<li>and https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.1.0 for more info</li>
</ul>
</li>
<li>
<p>Restore SLES logrotate file, (bsc#1246091)</p>
</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-171=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP Applications 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-171=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64)
<ul>
<li>rabbitmq-server-plugins-4.1.5-160000.1.1</li>
<li>rabbitmq-server-4.1.5-160000.1.1</li>
<li>erlang-rabbitmq-client-4.1.5-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 16.0 (noarch)
<ul>
<li>rabbitmq-server-zsh-completion-4.1.5-160000.1.1</li>
<li>rabbitmq-server-bash-completion-4.1.5-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP Applications 16.0 (ppc64le x86_64)
<ul>
<li>rabbitmq-server-plugins-4.1.5-160000.1.1</li>
<li>rabbitmq-server-4.1.5-160000.1.1</li>
<li>erlang-rabbitmq-client-4.1.5-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP Applications 16.0 (noarch)
<ul>
<li>rabbitmq-server-zsh-completion-4.1.5-160000.1.1</li>
<li>rabbitmq-server-bash-completion-4.1.5-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-30219.html">https://www.suse.com/security/cve/CVE-2025-30219.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1246091">https://bugzilla.suse.com/show_bug.cgi?id=1246091</a>
</li>
</ul>
</div>