{
 "slug": "rabbitmq",
 "name": "RabbitMQ",
 "tagline": "Multi-protocol message broker with the management UI",
 "category": "messaging",
 "use_cases": [
  "amqp",
  "task-queues",
  "pub-sub"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Broadcom (Team RabbitMQ)",
  "url": "https://www.rabbitmq.com",
  "license": "MPL-2.0",
  "license_url": "https://github.com/rabbitmq/rabbitmq-server/blob/main/LICENSE-MPL-RabbitMQ"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443,
   5672,
   5671
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "4.4.0",
   "last_build": "2026-10-24",
   "entity_id": "prod-kgy7vj2fy7xn2",
   "ami_alias": "/aws/service/marketplace/prod-kgy7vj2fy7xn2/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-sch6va7mc4g7i",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "4.3.6",
   "last_build": "2026-09-20",
   "offer_id": "rabbitmq",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:rabbitmq:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.rabbitmq?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/rabbitmq/",
  "json": "https://lynxroute.com/products/rabbitmq/product.json"
 },
 "release_notes": [
  {
   "version": "4.3.6",
   "title": "RabbitMQ 4.4.0 - RabbitMQ upgraded to 4.4.0 (from 4.3.6). Feature release: quorum queues support delayed messages (x-opt-delivery-time is held until the given time, then delivered); AMQP 1.0 clients can claim sole ownership of a container ID, with new rabbitmqctl sole_connection commands; the new x-stream-initial-offset argument sets where an empty stream starts; AMQP listeners can bind to a Unix domain socket and every HTTP-based protocol, including the HTTP API, accepts multiple listeners; PBKDF2-HMAC-SHA256 is available for password hashing; MQTT retained messages are capped per virtual host (100,000 messages, 1 GiB by default); STOMP is now a standalone protocol; the classic queue message store gains a new on-disk file format; the management UI loads faster through a new /api/init endpoint and can set a Referrer-Policy header. Behaviour changes: password hashing via the HTTP API moves from GET to POST /api/auth/hash_password, passive declarations require configure, write or read permission, and OpenID Connect discovery is validated more strictly. connection_max and channel_max are renamed max_connections and max_channels (old names still accepted). Runs on Erlang/OTP 27. Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base.",
   "notes": "",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-20",
    "azure": "2026-09-20"
   }
  },
  {
   "version": "4.3.5",
   "title": "RabbitMQ 4.3.6 - RabbitMQ upgraded to 4.3.6 (from 4.3.5). Maintenance release: deleting an exchange now also deletes the bindings that pointed to it as a destination, with related fixes to auto-delete exchanges, transient queue cleanup and virtual-host deletion; quorum queue membership reconciliation no longer adds more replicas than the configured target; malformed urn:uuid: correlation or message IDs are rejected instead of raising during message-format conversion; an operation naming an unknown queue type fails with a precondition_failed channel exception instead of terminating the channel; classic queue recovery no longer double-counts message store references; stream x-max-age values are compared as durations, so redeclaring with 1D after 24h no longer fails; AMQP 1.0 SQL LIKE patterns bound the matched value independently of the message size limit; direct connections used by the shovel and federation plugins enforce channel_max_per_node. New settings: channel_tx_message_max (default 10,000 buffered publishes per open AMQP 0-9-1 transaction) and listeners.startup_delay. Several channel interceptors may now share one AMQP 0-9-1 operation via per-module priorities. Runs on Erlang/OTP 27. Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base.",
   "notes": "",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-08-23",
    "azure": "2026-08-19"
   }
  },
  {
   "version": "4.3.4",
   "title": "RabbitMQ 4.3.5 - RabbitMQ upgraded to 4.3.5 (from 4.3.4). Maintenance release: a direct reply-to message routed to several targets that resolve to the same process is no longer delivered more than once; quorum queue recovery from a checkpoint no longer leaves internal state partially initialised; a malformed AMQP 1.0 frame returns a framing error to the client instead of raising an exception, and message sections are validated more strictly; topic exchange binding keys are limited to two multi-segment (#) wildcards; refreshed OAuth 2 credentials now update the user's tags instead of carrying over the original ones; definition import over HTTPS works with a password-protected TLS client certificate. Authentication events are logged under a new \"user\" category, successes at info and failures at warning. Runs on Erlang/OTP 27. Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base.",
   "notes": "",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-24",
    "azure": "2026-07-27"
   }
  },
  {
   "version": "4.3.3",
   "title": "RabbitMQ 4.3.3 - July 2026",
   "notes": "* RabbitMQ 4.3.3 on Ubuntu 24.04 LTS - version update from 4.3.2 (security and bugfix patch; no breaking changes, no migration)\n* Security fixes: cryptographically secure random salts for password hashing, safer management UI template escaping, tighter JMS selector limits, and an OAuth2 sign-in fix for Safari\n* Minimum Erlang/OTP raised to 27.0+ (OTP 26 is end-of-life) - this image already runs Erlang/OTP 27.3.4.14\n* Invalid consumer_timeout values now fall back to the 24-hour default; new optional stream.max_super_stream_partitions setting (default 1000)\n* Bundled ra 3.1.9 and cowboy 2.17.0; MPL-2.0 license unchanged\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n* CVE-scanned before every release\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-21",
    "azure": "2026-07-22"
   }
  },
  {
   "version": "4.3.2",
   "title": "RabbitMQ 4.3.2 - Initial release (June 2026)",
   "notes": "* RabbitMQ 4.3.2 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Unique admin user generated at first boot; default guest/guest account deleted\n* Per-instance Erlang cookie generated at first boot\n* Management UI bound to 127.0.0.1; TLS terminated by nginx on 443\n* Native AMQPS (TLS) on 5671 with a per-instance self-signed certificate\n* Bundled rabbitmq_management plugin; single node on Erlang/OTP 27\n* UFW firewall pre-configured (ports 22, 443, 5672, 5671 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-23"
   }
  }
 ],
 "release_history": [
  {
   "version": "4.4.0",
   "aws": "2026-10-24"
  },
  {
   "version": "4.3.6",
   "aws": "2026-09-20",
   "azure": "2026-09-20"
  },
  {
   "version": "4.3.5",
   "aws": "2026-08-23",
   "azure": "2026-08-19"
  },
  {
   "version": "4.3.4",
   "aws": "2026-07-24",
   "azure": "2026-07-27"
  },
  {
   "version": "4.3.3",
   "aws": "2026-07-21",
   "azure": "2026-07-22"
  },
  {
   "version": "4.3.2",
   "aws": "2026-06-23"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-kgy7vj2fy7xn2/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer rabbitmq --plan payg-gen2\naz vm create -g my-rg -n rabbitmq --size Standard_D2s_v3 \\\n  --image lynxroute:rabbitmq:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "RabbitMQ is an open-source message broker from Team RabbitMQ (Broadcom), implemented in Erlang/OTP and one of the most widely deployed brokers for the AMQP 0-9-1 protocol, with STOMP, MQTT, and WebSocket support via plugins. It routes messages between producers and consumers through exchanges, queues, and bindings, supporting work queues, publish/subscribe, routing, topics, and request/reply, with durable queues, publisher confirms, consumer acknowledgements, dead-lettering, TTLs, and quorum queues for replicated, fault-tolerant delivery. A bundled web management UI provides queue, exchange, connection, and user administration plus live metrics over an HTTP API. Broker state (virtual hosts, queues, users, and persistent messages) is stored on the local filesystem. This image runs a single node on Erlang/OTP 27. MPL-2.0 license - a self-hosted alternative to hosted queue services, with no per-message fees and no vendor lock-in.",
  "image_adds": "Security hardening:\n* Unique admin user (administrator tag) generated per instance at first boot; the default guest/guest account is deleted\n* A per-instance Erlang cookie generated at first boot (not a shared baked-in secret)\n* Management UI bound to 127.0.0.1 only, behind an nginx TLS reverse proxy on 443; RabbitMQ enforces its own login\n* Native AMQPS (TLS) on 5671 with a per-instance self-signed certificate; plaintext AMQP on 5672\n* UFW firewall - ports 22 (SSH), 443 (management UI), 5672 (AMQP), 5671 (AMQPS) only\n* fail2ban, AppArmor\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}