Release notes from rabbitmq-server

RabbitMQ 4.3.6

2026-09-14T07:26:21Z

RabbitMQ 4.3.6 is a maintenance release in the 4.3.x release series.

It is strongly recommended that you read 4.3.0 release notes
in detail if upgrading from a version prior to 4.3.0.

Minimum Supported Erlang Version

The minimum supported Erlang version for this release series is 27.0.

RabbitMQ and Erlang/OTP Compatibility Matrix has more details on Erlang version requirements for RabbitMQ.

Nodes will fail to start on older Erlang releases.

Changes Worth Mentioning

Release notes can be found on GitHub at rabbitmq-server/release-notes.

Core Server

Bug Fixes

Deleting an exchange did not delete the bindings that pointed to it as a destination.
A few related cases around auto-delete exchanges, transient queue cleanup and
virtual host deletion were fixed along the way.

GitHub issues: #17255, #17257
Quorum queue continuous membership reconciliation could add more replicas than
the configured target.

GitHub issues: #17310, #17311
Certain malformed urn:uuid: correlation or message ID caused exceptions during message format conversion.
Such values are now rejected.

GitHub issue: #17328
An operation that refers to an unknown queue type now fails with a
precondition_failed channel exception instead of an exception and abrupt channel termination.

GitHub issue: #17327
Classic queue recovery counted some message store references more than once.

GitHub issue: #17351
x-max-age values are now compared as durations, so redeclaring a stream
with 1D when it was declared with 24h no longer fails with a
PRECONDITION_FAILED (non-equivalent argument) exception.

With contributions from @Vishal-770.

GitHub issues: #8509, #17259
AMQP 1.0 SQL filters: the value matched by a LIKE pattern with several
wildcards is now bounded independently of the message size limit.

GitHub issue: #17332
Direct connections (used by the shovel and federation plugins) now enforce channel_max_per_node
the same way network connections do.

Contributed by @Ayanda-D.

GitHub issue: #16610

Enhancements

New rabbitmq.conf setting: channel_tx_message_max. It bounds the number of publishes a channel
buffers in an open AMQP 0-9-1 transaction, and defaults to 10,000. Going over the limit
results in a precondition_failed channel exception.

Most applications won't be affected by this change and likely will not have to
increase the default limit.

GitHub issue: #17331
New rabbitmq.conf setting: listeners.startup_delay. It delays the start of client connection
listeners by the specified number of seconds, for environments where applications
begin connecting as soon as a port is open, before the node has finished booting.

Contributed by @Vishal-770.

GitHub issues: #13153, #17289
Several channel interceptors can now be registered for the same AMQP 0-9-1 operation,
as long as they use different priorities. Previously, if two enabled plugins intercepted
the same operation, for example basic.publish, channels could not be opened at all.

Priorities are set per interceptor module in rabbitmq.conf. Lower values run first,
and omitted interceptors are assumed to have the priority of 0:
```
channel_interceptor.priorities.rabbit_timestamp_interceptor = 1
channel_interceptor.priorities.rabbit_routing_node_stamp_interceptor = 2
channel_interceptor.priorities.rabbit_sharding_interceptor = 3
```
Contributed by @Ayanda-D.

GitHub issue: #17182
Shovels now support a new AMQP URI query parameter, customize_hostname_check,
that controls how the target hostname is matched against the server certificate,
for example with wildcard certificates.

Contributed by @jiangranwang.

GitHub issue: #17221

CLI Tools

Bug Fixes

rabbitmq-diagnostics check_certificate_expiration now handles certificate files
that cannot be read, and certificates that use the RFC 5280 UTCTime format,
the same way the HTTP API health check does.

Contributed by @Vishal-770.

GitHub issues: #12464, #17345

Enhancements

Two new commands, rabbitmqctl list_channel_interceptors and
rabbitmqctl set_channel_interceptor_priorities, list the active channel interceptors
and adjust their priorities at runtime. Priorities set this way are not persisted
and do not survive a node restart.

Contributed by @Ayanda-D.

GitHub issue: #17182

Stream Plugin

Bug Fixes

During a rolling upgrade, a stream metadata request could leave out a peer node
that ran a different version.

GitHub issue: #17333

Stream Management Plugin

Bug Fixes

The publishers and consumers listing now verifies virtual host access like
other comparable HTTP API endpoints.

GitHub issues: #17236, #17239

Management Plugin

Bug Fixes

The channels list and individual channel pages now display basic information
when management statistics are disabled, instead of returning a 400 Bad Request.

GitHub issues: #8240, #17198
Several HTTP API endpoints returned a 500 instead of a 400 for invalid
range parameters or an invalid timeout header: GET /api/nodes/{node},
GET /api/healthchecks/node[/{node}], GET /api/federation-links,
GET /api/health/checks/alarms and GET /api/health/checks/local-alarms.

GitHub issues: #17245, #17247
The certificate expiration health check no longer responds with a 500
for certificate files that cannot be read, or for certificates that use the
RFC 5280 UTCTime format.

Contributed by @Vishal-770.

GitHub issues: #12464, #17345
Optional argument (x-*) values are no longer coerced to strings in the management UI.

GitHub issue: #17177

Enhancements

Consumers on protocols without channels (for example, AMQP 1.0 and MQTT)
now link directly to their connection in the management UI.

Contributed by @vampirebyte.

GitHub issue: #17206

Shovel Plugin

Bug Fixes

Shovel types provided by plugins can now be used as src-protocol and dest-protocol values.

GitHub issues: #17341, #17343
A local shovel with src-delete-after set to a number could in some cases
transfer more messages than that number.

GitHub issue: #17209

MQTT Plugin

Enhancements

The retained message store now has per-virtual host limits on both the number of messages
and their total size: mqtt.retained_message_store.max_messages (defaults to 100000)
and mqtt.retained_message_store.max_size_bytes (defaults to 1 GiB).

GitHub issue: #17189

STOMP Plugin

Bug Fixes

STOMP and Web STOMP connections now enforce credential expiry (for example, of OAuth 2 tokens)
the same way other protocols do.

GitHub issue: #17244

Web MQTT and Web STOMP Plugins

Bug Fixes

web_mqtt.ssl.* and web_stomp.ssl.* now accept more TLS keys in rabbitmq.conf,
including verify and fail_if_no_peer_cert.

GitHub issues: #17298, #17304

LDAP AuthN and AuthZ Backend Plugin

Bug Fixes

DN escaping introduced in an earlier release was too strict for certain Active Directory
setups, for example when the client provides a full DN that contains a backslash.
Escaping is now applied to DN template values only.

GitHub issues: #17277, #17278
Active Directory down-level logon names (DOMAIN\username) can be used to log in again.

Contributed by @jiangranwang.

GitHub issue: #17220

Trust Store Plugin

Enhancements

The trust store now also covers the HTTP API, Web MQTT
and Web STOMP listeners.

GitHub issue: #17303

Consul Peer Discovery Plugin

Bug Fixes

A 404 response from the Consul API no longer stops node boot; peer discovery is retried instead.

GitHub issues: #17211, #17215

Dependency Changes

cowboy was upgraded to 2.19.0
cowlib was upgraded to 2.20.0
gun was upgraded to 2.6.0
khepri was upgraded to 0.18.1
ranch was upgraded to 2.3.0

RabbitMQ 4.3.5

2026-08-17T21:42:00Z

RabbitMQ 4.3.5 is a maintenance release in the 4.3.x release series.

It is strongly recommended that you read 4.3.0 release notes
in detail if upgrading from a version prior to 4.3.0.

Minimum Supported Erlang Version

The minimum supported Erlang version for this release series is 27.0.

RabbitMQ and Erlang/OTP Compatibility Matrix has more details on Erlang version requirements for RabbitMQ.

Nodes will fail to start on older Erlang releases.

Changes Worth Mentioning

Release notes can be found on GitHub at rabbitmq-server/release-notes.

Core Server

Bug Fixes

With direct reply-to, a message routed to multiple
targets that resolved to the same process could be delivered to it more than once.

GitHub issue: #17071
Quorum queue recovery from a recovery checkpoint could leave a part of the queue's
internal state only partially initialized.

GitHub issue: #17012
In clusters that run a mix of 4.2.x and 4.3.x nodes during a rolling upgrade,
local quorum queue queries now fall back to the previous state machine version
instead of failing.

GitHub issue: #17128
A malformed AMQP 1.0 frame now results in a framing error returned to the client
instead of an exception.

GitHub issue: #17101
The AMQP 1.0 message parser now validates message sections more strictly
and decodes certain types of arrays more efficiently.

GitHub issue: #17049
Topic exchanges now limit the number of multi-segment (#) wildcards a binding key
can use to two. The # wildcard is meant to be used as the final segment, that is, just once.

GitHub issue: #17039
When connection credentials are refreshed (for example, when an OAuth 2 token
is renewed), the user's tags are now updated instead of being carried over from the
original state.

GitHub issue: #17029
Definition import from an HTTPS endpoint
no longer fails when a password-protected TLS (HTTPS) client certificate is used.

Contributed by @Pyolar.

GitHub issue: #16973
The AMQP 1.0 Erlang client no longer logs an exception when a link is already detached.
Workloads that use short lived links could produce a substantial amount of log noise.

GitHub issue: #17124

Enhancements

Authentication events are now logged under a new logging category, user.
Successful logins are logged at the info level, failed login attempts at the warning level.

GitHub issue: #16907

CLI Tools

Enhancements

rabbitmqctl hash_password now supports more password hashing functions.

GitHub issues: #14215, #17108

Stream Plugin

Bug Fixes

A stream protocol connection can have at most 256 publishers and 256 subscriptions,
a limit that comes from the protocol's wire format. Attempts to go over these limits
are now rejected early with a clear error instead of failing later with an unrelated one.

GitHub issue: #17123

Enhancements

Before a stream client connection completes authentication and authorization (that is, before
a successful open), the server now enforces a low frame_max ceiling instead of
the full configured value. The default, 8192 bytes, is high enough to accommodate realistic
JWT tokens used with SASL PLAIN authentication,
and mirrors a mechanism already in place for AMQP 0-9-1 connections. It can be adjusted
with the new stream.initial_frame_max setting.

GitHub issue: #17053
New setting: stream.max_uncompressed_sub_entry_batch_size. It bounds the declared
uncompressed size of a published sub-entry batch, and defaults to 67108864 (64 MiB),
the same default already used by the Java client's maxUncompressedSubEntryBatchSize.
The broker and any client publishing to it should be configured with the same value.

GitHub issue: #17103

Management Plugin

Bug Fixes

HTTP API endpoints that accept a node name, including the federation and tracing related ones,
now validate that the target node is a cluster member.

GitHub issues: #17106, #17118
The management UI no longer displays certain alert messages twice.

GitHub issue: #17127

Enhancements

When management.credential_encryption_secret is configured, the management UI login endpoint
(POST /api/login) returns client credentials encrypted using AES-256-GCM with a key
derived from the configured secret, and returns the ciphertext as an opaque token prefixed
with rmqe.. The browser stores this token and presents it on all subsequent requests
using the Authorization: Bearer rmqe.<token> header.

The secret MUST be identical on every node in the cluster.

Important: during a rolling cluster upgrade, enable this feature only after all nodes have been upgraded.
This is particularly important for clusters behind a load balancer: nodes that run older
versions will not recognize the encrypted tokens and will reject the requests,
unexpectedly logging users out.

GitHub issue: #16705
GET /api/definitions now supports conditional requests (ETag).

The ETag value is derived from the metadata store Raft index, so the tag will
naturally change as the metadata store serves writes.

GitHub issues: #16724, #17121
The Referrer-Policy HTTP response header can now be configured with
the management.headers.referrer_policy setting.

GitHub issue: #16893
When management.http.hide_allow_header is set to true, the Allow HTTP response header
is omitted from all responses except 405 Method Not Allowed ones, where it is required
by the HTTP specification. This avoids disclosing the supported HTTP methods to clients.

GitHub issue: #16893
When management.definitions.require_json_extension is set to true, both the management UI
and the HTTP API will reject definition upload where the file does not have a .json extension.
The setting defaults to false. Regardless of this setting, the server always validates
that the uploaded content is valid JSON before importing it.

GitHub issue: #16946

OAuth 2 AuthN and AuthZ Backend Plugin

Bug Fixes

When RabbitMQ is behind a proxy that terminates TLS, the OAuth 2 login flow
now honors the X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port headers
when rewriting the token endpoint URL in the OpenID discovery payload.

GitHub issue: #17153

Shovel Plugin

Bug Fixes

Reduced log noise.

GitHub issue: #17028
Static shovels that do not define any declarations failed to start.

GitHub issues: #17063, #17067
When a topology setup failure stops a shovel worker, the specific reason is now
reported instead of a generic one.

GitHub issue: #17135
The Shovel HTTP API now processes shovel URIs the same way the federation plugin
processes its upstream URIs.

GitHub issue: #17134

Enhancements

Shovel TTL: dynamic shovels support a new setting, src-delete-after-duration,
that instructs the shovel to self-delete after at least the specified duration.

Contributed by @michalovits.

GitHub issues: #17055, #17064

Federation Plugin

Bug Fixes

A malformed upstream URI could prevent a federation link from starting even when other,
well-formed URIs were available. All candidate URIs are now tried.

Contributed by @sauravonwww.

GitHub issue: #17046

MQTT Plugin

Bug Fixes

Packets split across many network fragments are now parsed more efficiently.

GitHub issue: #17093
MQTT 5.0 properties are now parsed strictly: a property that is not valid
for a given packet type is rejected.

GitHub issue: #17039
A Receive Maximum value of 0, prohibited by the MQTT 5.0 specification, is now rejected.

GitHub issue: #17035

STOMP Plugin

Bug Fixes

Frame size limits are now enforced earlier in the connection lifecycle.

GitHub issue: #17116

Web STOMP Plugin

Bug Fixes

The accumulated frame size is now checked against max_frame_size after a connection
has authenticated, matching the behavior of "regular" STOMP connections.

GitHub issue: #17065

Consistent Hash Exchange Plugin

Bug Fixes

An edge case in bucket selection is now handled gracefully.

GitHub issue: #17081

Dependency Changes

cowboy was upgraded to 2.18.0
cowlib was upgraded to 2.19.0
gun was upgraded to 2.5.0
ra was upgraded to 3.1.10
ranch was upgraded to 2.2.1

RabbitMQ 4.3.4

2026-08-26T13:57:29Z

RabbitMQ 4.3.4 is a maintenance release in the 4.3.x release series.

It is strongly recommended that you read 4.3.0 release notes
in detail if upgrading from a version prior to 4.3.0.

Minimum Supported Erlang Version

The minimum supported Erlang version for this release series is 27.0.

RabbitMQ and Erlang/OTP Compatibility Matrix has more details on Erlang version requirements for RabbitMQ.

Nodes will fail to start on older Erlang releases.

Changes Worth Mentioning

Release notes can be found on GitHub at rabbitmq-server/release-notes.

Core Server

Bug Fixes

Quorum queues in clusters upgraded from 3.13.x to 4.2.x and then to 4.3.x could stop
emitting metrics and taking snapshots after a node restart.

GitHub issues: #16974, #16990
The AMQP 1.0 parser now detects standard message body sections more strictly.

GitHub issue: #17017
The AMQP 1.0 parser now decodes certain array values more efficiently.

GitHub issue: #16994

Stream Plugin

Bug Fixes

The single active consumer coordinator
did not notify a consumer that was re-selected for activation while it was still deactivating,
leaving the group without an active consumer.

Contributed by @pterygota.

GitHub issues: #16975, #16976

Management Plugin

Bug Fixes

Very short lived exclusive queues could cause an exception during metric collection, producing
log noise.

GitHub issues: #16989, #16999, #17002
After an IdP-initiated OAuth 2 login, the management UI now returns the user
to the page that was open before the login instead of the default one.

Contributed by @thisisnsh.

GitHub issues: #16957, #16961
Several security fixes and validation gaps were addressed:
- The HTTP API now returns 404 Not Found instead of 401 Unauthorized when a user lacks permission to a vhost, avoiding disclosure of the vhost's existence.
- Token expiry values that use a floating point number are now accepted, not just integers.
- To access all user-limits it is required administrator priviledge
- To access a user-limits for a specific user now require the requester to be that same user or have administrator/monitoring privileges.
GitHub issue: #16709

Enhancements

The management UI Content Security Policy (CSP) no longer includes the unsafe-eval and
unsafe-inline directives.

GitHub issue: #16916

Federation Plugin

Bug Fixes

In scenarios that involved a federated queue and a federated exchange with exactly the same name in the same virtual host,
deleting an upstream unintentionally corrupted the federated exchange(s) operating state, breaking federation
for the exchange in question.

GitHub issues: #16991, #16997

Dependency Changes

None in this release.

RabbitMQ 4.2.9

2026-07-20T15:59:46Z

RabbitMQ 4.2.9 is a maintenance release in the 4.2.x release series.

It is strongly recommended that you read 4.2.0 release notes
in detail if upgrading from a version prior to 4.2.0.

Minimum Supported Erlang Version

Important: starting with this release, the minimum supported Erlang version is 27.0. Erlang/OTP 26 has reached
end of life and is no longer supported.

GitHub issue: #16914

RabbitMQ and Erlang/OTP Compatibility Matrix has more details on Erlang version requirements for RabbitMQ.

Nodes will fail to start on older Erlang releases.

Changes Worth Mentioning

Release notes can be found on GitHub at rabbitmq-server/release-notes.

Core Server

Bug Fixes

Classic queue index directory paths could accumulate slashes, eventually failing
with an enametoolong file system error.

GitHub issue: #16833
AMQP 1.0 management operations that declare an exchange with an alternate exchange now verify
the necessary permissions on the alternate exchange, matching AMQP 0-9-1.

GitHub issue: #16785
AMQP 1.0 management GET /bindings operations now behave consistently with the rest
of the binding-related handlers.

GitHub issue: #16790
Worker pool processes no longer terminate when they receive an unexpected message.

Contributed by @Ayanda-D.

GitHub issue: #16666
A race condition between concurrent queue (or virtual host) deletion and a Ra cluster shutdown
could log an exception.

Contributed by @Ayanda-D.

GitHub issue: #16880
A closing channel (connection) that failed to send channel.close_ok on an already terminated
writer or socket no longer produce log noise.

Contributed by @Ayanda-D.

GitHub issue: #16651
Unexpected failures during channel termination cleanup no longer produce log noise.

Contributed by @Ayanda-D.

GitHub issue: #16740
Code paths that use rabbit_queue_type_util:erpc_call/5 now handle more errors.

Contributed by @Ayanda-D.

GitHub issue: #16701
Nodes could fail to start with a bad_generator exception in rabbit_queue_decorator:select/1
when a quorum queue record in the metadata store had its decorators set to undefined.

GitHub issues: #16843, #16844
Enabling tracing on multiple virtual hosts concurrently could silently drop
some of the virtual hosts from the traced set. All virtual host tracing state modifications
are now linearized.

GitHub issues: #16755, #16763

Enhancements

Password salts are now generated using a cryptographically secure pseudo-random number generator (CSPRNG).

GitHub issue: #16775
Socket-level metric collection used by several protocol readers and the management agent
now handles concurrently closed connections safely.

Inspired by a contribution of @MugemaneBertin2001.

GitHub issues: #16856, #16832

CLI Tools

Bug Fixes

rabbitmq-plugins commands now tolerate plugins that are listed as enabled but are not installed.

GitHub issue: #16896
rabbitmq-plugins list no longer outputs an empty plugin table when the target node
cannot be reached.

GitHub issue: #16791
rabbitmq-plugins commands now correctly handle file paths of remote nodes, validate remote nodes
in offline mode, and no longer report false positives for rabbitmq-plugins is_enabled.

GitHub issue: #16842
Shell (Bash, zsh) command completion fixes.

Contributed by @Chr1s70ph.

GitHub issue: #16776

Enhancements

rabbitmq-queues and rabbitmq-streams now provide transfer_leadership commands
for individual queues and streams.

GitHub issue: #16757
rabbitmq-upgrade drain safety improvements: the command now handles certain failures
more gracefully.

Proposed by @MugemaneBertin2001.

GitHub issues: #16865, #3369

Stream Plugin

Bug Fixes

Permissions required for certain stream protocol operations were adjusted to be consistent
with comparable operations over other protocols.

GitHub issue: #16754

Enhancements

The maximum number of super stream partitions is now limited to 1,000 partitions by default.
This limit can be increased using the stream.max_super_stream_partitions key in rabbitmq.conf.

GitHub issues: #16689, #16706
A client RPC timeout is now logged as a concise message instead of an exception
with a stack trace.

Contributed by @MugemaneBertin2001.

GitHub issues: #16829, #15744

Management Plugin

Bug Fixes

OAuth 2 login could fail in Safari. A new token endpoint proxy is now used
for the affected authorization flow.

GitHub issues: #16664, #16892
Several management UI templates now use safe string escaping in more places.

GitHub issue: #16738, #16677
HTTP API message publishing endpoint now uses a timeout when waiting for publisher confirms.

GitHub issue: #16911

Enhancements

Definition export over the HTTP API is now significantly more efficient and
transfers the result using HTTP response streaming.

GitHub issue: #16734
The Referrer-Policy HTTP response header is now set (and configurable).

GitHub issue: #16893
HTTP API error responses were refactored to be more consistent and expose fewer internal details.

GitHub issue: #16709

OAuth 2 AuthN and AuthZ Backend Plugin

Bug Fixes

Fractional exp (token expiry) timestamp values are now honored.

GitHub issue: #16713

Enhancements

The token refresh path is now more robust.

GitHub issue: #16858

Shovel Plugin

Bug Fixes

Several shovel bug fixes, including one for static shovel URIs whose credentials
could be logged.

GitHub issues: #16855, #16835
A shovel deleted before it successfully connected (in the starting state) no longer
leaks its status entry.

GitHub issue: #16767

Federation Plugin

Bug Fixes

Federation upstream URIs are now validated more strictly.

GitHub issue: #16942

MQTT Plugin

Enhancements

More correct peer host detection in setups that have Proxy Protocol enabled.

GitHub issue: #16933

Web MQTT Plugin

Enhancements

More correct peer host detection in setups that have Proxy Protocol enabled.

GitHub issue: #16933
The HSTS response header policy can now be configured for Web MQTT listeners.

GitHub issues: #14161, #16772

STOMP Plugin

Enhancements

Internal socket handling refactoring shared by STOMP and Web STOMP connections.

GitHub issue: #16935

Web STOMP Plugin

Enhancements

More correct peer host detection in setups that have Proxy Protocol enabled.

GitHub issue: #16935
The HSTS response header policy can now be configured for Web STOMP listeners.

GitHub issues: #14161, #16772

LDAP AuthN and AuthZ Backend Plugin

Bug Fixes

Additional DN escaping (RFC 4514) improvements

GitHub issue: #16712

JMS Topic Exchange Plugin

Enhancements

JMS selector evaluation now uses much smaller, safer limits.

GitHub issue: #16951

AWS Peer Discovery Plugin

Bug Fixes

Fixed a SigV4 request signing issue (SignatureDoesNotMatch) for body-less requests such as S3 GETs.

Contributed by @sdewhitt.

GitHub issue: #16759

Dependency Changes

cowboy was upgraded to 2.17.0

RabbitMQ 4.3.3

2026-07-20T16:00:02Z

RabbitMQ 4.3.3 is a maintenance release in the 4.3.x release series.

It is strongly recommended that you read 4.3.0 release notes
in detail if upgrading from a version prior to 4.3.0.

Minimum Supported Erlang Version

Important: starting with this release, the minimum supported Erlang version is 27.0. Erlang/OTP 26 has reached
end of life and is no longer supported.

GitHub issue: #16914

RabbitMQ and Erlang/OTP Compatibility Matrix has more details on Erlang version requirements for RabbitMQ.

Nodes will fail to start on older Erlang releases.

Changes Worth Mentioning

Release notes can be found on GitHub at rabbitmq-server/release-notes.

Core Server

Bug Fixes

Quorum queue, Khepri and other Raft leaders could optimistically commit new log entries in certain scenarios.

GitHub issue: rabbitmq/ra#637
Quorum queues that use at-least-once dead lettering could get their
dead lettering process permanently stuck after repeated queue membership changes.

GitHub issue: #16652
Classic queue index directory paths could accumulate slashes, eventually failing
with an enametoolong file system error.

GitHub issue: #16833
Enabling the tie_binding_to_dest_with_keep_while_cond feature flag could fail with an exception
when certain exchange-to-exchange topologies.

GitHub issue: #16824
An invalid consumer_timeout value in the configuration now falls back to the default
value (24 hours) instead of being used as is.

GitHub issue: #16799
AMQP 1.0 management operations that declare an exchange with an alternate exchange now verify
the necessary permissions on the alternate exchange, matching AMQP 0-9-1.

GitHub issue: #16785
AMQP 1.0 management GET /bindings operations now behave consistently with the rest
of the binding-related handlers.

GitHub issue: #16790
Worker pool processes no longer terminate when they receive an unexpected message.

Contributed by @Ayanda-D.

GitHub issue: #16666
A race condition between concurrent queue (or virtual host) deletion and a Ra cluster shutdown
could log an exception.

Contributed by @Ayanda-D.

GitHub issue: #16880
A closing channel (connection) that failed to send channel.close_ok on an already terminated
writer or socket no longer produce log noise.

Contributed by @Ayanda-D.

GitHub issue: #16651
Unexpected failures during channel termination cleanup no longer produce log noise.

Contributed by @Ayanda-D.

GitHub issue: #16740
Code paths that use rabbit_queue_type_util:erpc_call/5 now handle more errors.

Contributed by @Ayanda-D.

GitHub issue: #16701
Nodes could fail to start with a bad_generator exception in rabbit_queue_decorator:select/1
when a quorum queue record in the metadata store had its decorators set to undefined.

GitHub issues: #16843, #16844
Enabling tracing on multiple virtual hosts concurrently could silently drop
some of the virtual hosts from the traced set. All virtual host tracing state modifications
are now linearized.

GitHub issues: #16755, #16763

Enhancements

Password salts are now generated using a cryptographically secure pseudo-random number generator (CSPRNG).

GitHub issue: #16775
Socket-level metric collection used by several protocol readers and the management agent
now handles concurrently closed connections safely.

Inspired by a contribution of @MugemaneBertin2001.

GitHub issues: #16856, #16832

CLI Tools

Bug Fixes

rabbitmq-plugins commands now tolerate plugins that are listed as enabled but are not installed.

GitHub issue: #16896
rabbitmq-plugins list no longer outputs an empty plugin table when the target node
cannot be reached.

GitHub issue: #16791
rabbitmq-plugins commands now correctly handle file paths of remote nodes, validate remote nodes
in offline mode, and no longer report false positives for rabbitmq-plugins is_enabled.

GitHub issue: #16842
Shell (Bash, zsh) command completion fixes.

Contributed by @Chr1s70ph.

GitHub issue: #16776

Enhancements

rabbitmq-queues and rabbitmq-streams now provide transfer_leadership commands
for individual queues and streams.

GitHub issue: #16757
rabbitmq-upgrade drain safety improvements: the command now handles certain failures
more gracefully.

Proposed by @MugemaneBertin2001.

GitHub issues: #16865, #3369

Stream Plugin

Bug Fixes

Permissions required for certain stream protocol operations were adjusted to be consistent
with comparable operations over other protocols.

GitHub issue: #16754

Enhancements

The maximum number of super stream partitions is now limited to 1,000 partitions by default.
This limit can be increased using the stream.max_super_stream_partitions key in rabbitmq.conf.

GitHub issues: #16689, #16706
A client RPC timeout is now logged as a concise message instead of an exception
with a stack trace.

Contributed by @MugemaneBertin2001.

GitHub issues: #16829, #15744

Management Plugin

Bug Fixes

OAuth 2 login could fail in Safari. A new token endpoint proxy is now used
for the affected authorization flow.

GitHub issues: #16664, #16892
Several management UI templates now use safe string escaping in more places.

GitHub issue: #16738, #16677
HTTP API message publishing endpoint now uses a timeout when waiting for publisher confirms.

GitHub issue: #16911

Enhancements

Definition export over the HTTP API is now significantly more efficient and
transfers the result using HTTP response streaming.

GitHub issue: #16734
The Referrer-Policy HTTP response header is now set (and configurable).

GitHub issue: #16893
The Allow HTTP response header can now be excluded from HTTP API responses.

GitHub issue: #16907
HTTP API error responses were refactored to be more consistent and expose fewer internal details.

GitHub issue: #16709
HTTP access log entries for OAuth 2-authenticated requests now use the username determined
by the authentication backend (e.g. preferred_username) instead of the client ID.

GitHub issues: #16879, #16559
Definition file uploads via the management UI now require a .json file extension
(enabled via a feature switch).

GitHub issue: #16946

OAuth 2 AuthN and AuthZ Backend Plugin

Bug Fixes

Fractional exp (token expiry) timestamp values are now honored.

GitHub issue: #16713

Enhancements

The token refresh path is now more robust.

GitHub issue: #16858

Shovel Plugin

Bug Fixes

Several shovel bug fixes, including one for static shovel URIs whose credentials
could be logged.

GitHub issues: #16855, #16835
A shovel deleted before it successfully connected (in the starting state) no longer
leaks its status entry.

GitHub issue: #16767
Improved network failure recovery for shovels.

GitHub issue: #16662

Enhancements

Shovels with AMQP 1.0 sources now support the src-consumer-args parameter.

GitHub issue: #16800

Federation Plugin

Bug Fixes

Federation upstream URIs are now validated more strictly.

GitHub issue: #16942
Improved network failure recovery for shovels.

GitHub issue: #16662
Exchange federation links now trap exits later in the initialization process,
avoiding confusing timeouts and log noise.

GitHub issue: #16801

MQTT Plugin

Enhancements

More correct peer host detection in setups that have Proxy Protocol enabled.

GitHub issue: #16933

STOMP Plugin

Enhancements

Internal socket handling refactoring shared by STOMP and Web STOMP connections.

GitHub issue: #16935

Web MQTT Plugin

Enhancements

More correct peer host detection in setups that have Proxy Protocol enabled.

GitHub issue: #16933
The HSTS response header policy can now be configured for Web MQTT listeners.

GitHub issues: #14161, #16772

Web STOMP Plugin

Enhancements

More correct peer host detection in setups that have Proxy Protocol enabled.

GitHub issue: #16933
The HSTS response header policy can now be configured for Web STOMP listeners.

GitHub issues: #14161, #16772

LDAP AuthN and AuthZ Backend Plugin

Bug Fixes

Additional DN escaping (RFC 4514) improvements

GitHub issue: #16712

JMS Topic Exchange Plugin

Enhancements

JMS selector evaluation now uses much smaller, safer limits.

GitHub issue: #16951

AWS Peer Discovery Plugin

Bug Fixes

Fixed a SigV4 request signing issue (SignatureDoesNotMatch) for body-less requests such as S3 GETs.

Contributed by @sdewhitt.

GitHub issue: #16759

Dependency Changes

ra was upgraded to 3.1.9
cowboy was upgraded to 2.17.0

RabbitMQ 4.2.8

2026-06-15T15:19:19Z

RabbitMQ 4.2.8 is a maintenance release in the 4.2.x release series.

It is strongly recommended that you read 4.2.0 release notes
in detail if upgrading from a version prior to 4.2.0.

Minimum Supported Erlang Version

RabbitMQ and Erlang/OTP Compatibility Matrix has more details on Erlang version requirements for RabbitMQ.

Nodes will fail to start on older Erlang releases.

Changes Worth Mentioning

Release notes can be found on GitHub at rabbitmq-server/release-notes.

Core Server

Bug Fixes

Users created without a password or a password hash (for example, those that rely on
X.509 certificate-based authentication) over the HTTP API are now stored correctly,
exactly like the users whose password was cleared with rabbitmqctl clear_password.

GitHub issues: #16629, #16633
Consumer activity status of classic queue consumers was not always correctly updated and reported
when single active consumer was enabled.

GitHub issues: #16532, #16450
Default queue type (DQT) validation now treats empty strings the same way as a missing value: by falling back
to the default (classic queues).

GitHub issues: #16481, #16488

Enhancements

The per-node channel limit (channel_max_per_node) is now also enforced for channels opened
on direct Erlang client connections used by the Shovel and Federation plugins, matching the behavior
enforced for "regular" AMQP 0-9-1 clients.

GitHub issues: #16616, #16618
Modules are now loaded in parallel early on node boot, reducing node startup time.

GitHub issue: #16479
Several new rabbitmq.conf keys now support encrypted values.

GitHub issue: #16632

CLI Tools

Bug Fixes

rabbitmqctl add_vhost now validates the provided default queue type value.

GitHub issue: #16481

Stream Plugin

Bug Fixes

Fixed a frame assembly performance regression in the stream protocol reader.

GitHub issue: #16588

Enhancements

Several stream protocol reader optimizations: stream metadata queries now contact cluster nodes concurrently,
subscription lookups use a more efficient data structure, and frame processing short-circuits
when a connection reaches a terminal state.

GitHub issue: #16588

Management Plugin

Bug Fixes

CORS hardening: access-control-request-headers values are now validated and
a wildcard (*) origin header value is rejected.

GitHub issue: #16544
Definitions import now limits the size of multipart upload bodies, and definitions export
download filenames are restricted to a safe character set.

GitHub issue: #16544
HTTP API 500 responses no longer include internal error details in the response body.

GitHub issue: #16544
Several HTTP response headers are now consistently lowercase, and a previously missing
content-type header was added to certain responses.

GitHub issue: #16544

Enhancements

A one-time warning is now logged when the HSTS or CSP headers are disabled.

GitHub issue: #16544
The timestamp of the oldest message in a stream is now displayed on the stream page.

GitHub issue: #15412

Prometheus Plugin

Enhancements

More plugin configuration keys, such as prometheus.ssl.password, now support
encrypted values in rabbitmq.conf.

GitHub issues: #16516, #16521

MQTT Plugin

Bug Fixes

mqtt.tcp_listen_options.* settings in rabbitmq.conf did not take effect
due to a configuration translation issue.

GitHub issue: #16529

Dependency Changes

cuttlefish was upgraded to 3.9.1
cowboy was upgraded to 2.16.0
cowlib was upgraded to 2.17.0
gun was upgraded to 2.4.0

RabbitMQ 4.3.2

2026-06-15T15:38:54Z

RabbitMQ 4.3.2 is a maintenance release in the 4.3.x release series.

It is strongly recommended that you read 4.3.0 release notes
in detail if upgrading from a version prior to 4.3.0.

Minimum Supported Erlang Version

RabbitMQ and Erlang/OTP Compatibility Matrix has more details on Erlang version requirements for RabbitMQ.

Nodes will fail to start on older Erlang releases.

Changes Worth Mentioning

Release notes can be found on GitHub at rabbitmq-server/release-notes.

Core Server

Bug Fixes

Enabling the tie_binding_to_dest_with_keep_while_cond feature flag could fail in some
rare cases.

GitHub issue: #16587
Users created without a password or a password hash (for example, those that rely on
X.509 certificate-based authentication) over the HTTP API are now stored correctly,
exactly like the users whose password was cleared with rabbitmqctl clear_password.

GitHub issues: #16629, #16633
Consumer activity status of classic queue consumers was not always correctly updated and reported
when single active consumer was enabled.

GitHub issues: #16532, #16450
The values of the x-consumer-timeout and x-consumer-disconnected-timeout optional arguments
are now validated at queue declaration time.

GitHub issue: #16557
Default queue type (DQT) validation now treats empty strings the same way as a missing value: by falling back.
to the default (classic queues).

GitHub issues: #16481, #16488
Feature flag operations now avoid unnecessary work: flags that are already enabled on all cluster nodes
are excluded from synchronization, and enabling an empty set of flags is a no-op.

GitHub issue: #16497
Configuration changes for deprecated features are now
honored when possible.

GitHub issue: #16500

Enhancements

The per-node channel limit (channel_max_per_node) is now also enforced for channels opened
on direct Erlang client connections used by the Shovel and Federation plugins, matching the behavior
enforced for "regular" AMQP 0-9-1 clients.

GitHub issues: #16616, #16618
Modules are now loaded in parallel early on node boot, reducing node startup time.

GitHub issue: #16479
Several new rabbitmq.conf keys now supports encrypted values.

GitHub issue: #16632

CLI Tools

Bug Fixes

rabbitmqctl set_topic_permissions now validates target user and exchange for existence.

GitHub issue: #16590
rabbitmqctl add_vhost now validates the provided default queue type value.

GitHub issue: #16481

Stream Plugin

Bug Fixes

Fixed a frame assembly performance regression in the stream protocol reader.

GitHub issue: #16588

Enhancements

Several stream protocol reader optimizations: stream metadata queries now contact cluster nodes concurrently,
subscription lookups use a more efficient data structure, and frame processing short-circuits
when a connection reaches a terminal state.

GitHub issue: #16588

Management Plugin

Bug Fixes

CORS hardening: access-control-request-headers values are now validated and
a wildcard (*) origin header value is rejected.

GitHub issue: #16544
Definitions import now limits the size of multipart upload bodies, and definitions export
download filenames are restricted to a safe character set.

GitHub issue: #16544
HTTP API 500 responses no longer include internal error details in the response body.

GitHub issue: #16544
Several HTTP response headers are now consistently lowercase, and a previously missing
content-type header was added to certain responses.

GitHub issue: #16544

Enhancements

A one-time warning is now logged when the HSTS or CSP headers are disabled.

GitHub issue: #16544
The timestamp of the oldest message in a stream is now displayed on the stream page.

GitHub issue: #15412
The queue list page can now display a "Delayed" message count column, for example, for
quorum queues that have a retry policy configured.

GitHub issue: #16639

Prometheus Plugin

Enhancements

More plugin configuration keys, such as prometheus.ssl.password, now support
encrypted values in rabbitmq.conf.

GitHub issues: #16516, #16521

MQTT Plugin

Bug Fixes

mqtt.tcp_listen_options.* settings in rabbitmq.conf did not take effect
due to a configuration translation issue.

GitHub issue: #16529

Dependency Changes

cuttlefish was upgraded to 3.9.1
cowboy was upgraded to 2.16.0
cowlib was upgraded to 2.17.0
gun was upgraded to 2.4.0

RabbitMQ 4.3.1

2026-05-20T01:26:36Z

RabbitMQ 4.3.1 is a maintenance release in the 4.3.x release series.

It is strongly recommended that you read 4.3.0 release notes
in detail if upgrading from a version prior to 4.3.0.

Minimum Supported Erlang Version

RabbitMQ and Erlang/OTP Compatibility Matrix has more details on Erlang version requirements for RabbitMQ.

Nodes will fail to start on older Erlang releases.

Changes Worth Mentioning

Release notes can be found on GitHub at rabbitmq-server/release-notes.

Core Server

Bug Fixes

If a queue was bound to a topic exchange using an empty binding key (""),
messages published to any topic exchange with an empty
routing key would be incorrectly routed to that queue.

To apply the fix, enable the new topic_binding_projection_v5 feature flag after upgrading all cluster nodes.

GitHub issue: #16271
A virtual host could be falsely considered to be deleted in certain metadata store error and timeout scenarios.

GitHub issue: #16422
Passive queue and exchange declarations are now allowed for users that have any permission
on the virtual host (configure, write, or read), not only configure.

GitHub issues: #16272, #16085
Classic queue shared message store GC could fall behind other queue activity under heavy load

GitHub issues: #16142, #16141
Classic queue message store: garbage collection is now stopped cleanly during node shutdown.

GitHub issue: #15498
Quorum queues now gracefully handle negative priority values.

GitHub issue: #16280
Quorum queues: delayed retry-related policy keys are now accepted in policy definitions.

GitHub issues: #16395, #16398
Fixed a bug where quorum queue's at-least-once dead lettering could direct commands to
the wrong member (replica).

GitHub issue: #16203
Quorum queues: reintroduced Raft WAL max entries default of 500K.

GitHub issue: #16382
A quorum queue could crash during recovery after an unclean shutdown

PR: rabbitmq/ra#629
Stream queue argument validation was improved.

GitHub issue: #16285

Enhancements

channel_max was renamed to max_channels in rabbitmq.conf. The original name is
still supported as an alias.

GitHub issue: #16347
connection_max was renamed to max_connections in rabbitmq.conf. The original name is
still supported as an alias.

GitHub issue: #16347
The per-node max_connections limit is now enforced for AMQP 1.0 connections as well as AMQP 0-9-1 ones.

GitHub issue: #16300
When a plain-text client connects to a TLS listener (or vice versa) for
AMQP 0-9-1, MQTT, STOMP, and the Stream protocol, target node will log a more useful message.

GitHub issues: #16342, #16344
The permission cache is now traversed less often during AMQP 1.0 management and AMQP 0-9-1 channel checks.

GitHub issue: #16274

Stream Plugin

Bug Fixes

Stream protocol: an open frame with empty properties is now handled correctly.

GitHub issue: #16341

Enhancements

It is now possible to cap the maximum number of concurrent Stream Protocol client
connections using the stream.max_connections configuration key in rabbitmq.conf.

GitHub issue: #16341

Management Plugin

Bug Fixes

HTTP API GET /api/connections could return a 500 response when STOMP connections were present.

GitHub issue: #16435

Enhancements

It is now possible to cap the maximum number of concurrent HTTP API connections using the management.tcp.max_connections,
management.ssl.max_connections configuration keys in rabbitmq.conf.

GitHub issue: #16407
The peer (client) certificate serial number is now exposed in the management UI and select CLI commands.

GitHub issue: #16463

Prometheus Plugin

Enhancements

It is now possible to cap the maximum number of concurrent HTTP API connections using the prometheus.tcp.max_connections,
prometheus.ssl.max_connections configuration keys in rabbitmq.conf.

GitHub issue: #16407

MQTT Plugin

Bug Fixes

The MQTT connection process no longer fails and logs an exception when keepalive checks encounter socket errors on
an already-closed connection.

GitHub issue: #16391

Enhancements

It is now possible to cap the maximum number of concurrent MQTT client connections using the mqtt.max_connections
configuration key in rabbitmq.conf.

GitHub issue: #16367

Federation Plugin

Bug Fixes

Federation links could fail to start during rolling cluster restarts.

GitHub issues: #16234, #16224

LDAP Plugin

Enhancements

New rabbitmq.conf configuration settings for TLS cipher suites: auth_ldap.ssl_options.ciphers.*.

GitHub issue: #16226

HTTP Auth Backend Plugin

Enhancements

New rabbitmq.conf configuration settings for TLS cipher suites: auth_http.ssl_options.ciphers.*.

GitHub issue: #16226

Auth Backend Cache Plugin

Bug Fixes

The cache was not effective for reconnecting clients.

GitHub issues: #16255, #16258

Trust Store Plugin

Bug Fixes

A user-provided fail_if_no_peer_cert value in the plugin's TLS options is now respected. Previously,
an internal default could override the configured value.

GitHub issue: #16201

Enhancements

New rabbitmq.conf configuration settings for TLS cipher suites: trust_store.ssl_options.ciphers.*.

GitHub issue: #16226

Dependency Changes

ra was upgraded to 3.1.7
cuttlefish was upgraded to 3.7.0
cowboy was upgraded to 2.15.0
cowlib was upgraded to 2.16.1
gun was upgraded to 2.3.0

RabbitMQ 4.2.7

2026-05-20T00:10:20Z

RabbitMQ 4.2.7 is a maintenance release in the 4.2.x release series.

It is strongly recommended that you read 4.2.0 release notes
in detail if upgrading from a version prior to 4.2.0.

Minimum Supported Erlang Version

RabbitMQ and Erlang/OTP Compatibility Matrix has more details on Erlang version requirements for RabbitMQ.

Nodes will fail to start on older Erlang releases.

Changes Worth Mentioning

Release notes can be found on GitHub at rabbitmq-server/release-notes.

Core Server

Bug Fixes

A virtual host could be falsely considered to be deleted in certain metadata store error and timeout scenarios.

GitHub issue: #16422
Passive queue and exchange declarations are now allowed for users that have any permission
on the virtual host (configure, write, or read), not only configure.

GitHub issue: #16272
Classic queue message store: garbage collection is now stopped cleanly during node shutdown.

GitHub issue: #15498
Fixed a bug where quorum queue's at-least-once dead lettering could direct commands to
the wrong member (replica).

GitHub issue: #16203
Stream queue argument validation was improved.

GitHub issue: #16285

Enhancements

channel_max was renamed to max_channels in rabbitmq.conf. The original name is
still supported as an alias.

GitHub issue: #16347
connection_max was renamed to max_connections in rabbitmq.conf. The original name is
still supported as an alias.

GitHub issue: #16347
The per-node max_connections limit is now enforced for AMQP 1.0 connections as well as AMQP 0-9-1 ones.

GitHub issue: #16300
The permission cache is now traversed less often during AMQP 1.0 management and AMQP 0-9-1 channel checks.

GitHub issue: #16274

Stream Plugin

Bug Fixes

Stream protocol: an open frame with empty properties is now handled correctly.

GitHub issue: #16341

Enhancements

It is now possible to cap the maximum number of concurrent Stream Protocol client
connections using the stream.max_connections configuration key in rabbitmq.conf.

GitHub issue: #16341

Management Plugin

Bug Fixes

HTTP API GET /api/connections could return a 500 response when STOMP connections were present.

GitHub issue: #16435

Enhancements

It is now possible to cap the maximum number of concurrent HTTP API connections using the management.tcp.max_connections,
management.ssl.max_connections configuration keys in rabbitmq.conf.

GitHub issue: #16407
The peer (client) certificate serial number is now exposed in the management UI and select CLI commands.

GitHub issue: #16463

Prometheus Plugin

Enhancements

It is now possible to cap the maximum number of concurrent HTTP API connections using the prometheus.tcp.max_connections,
prometheus.ssl.max_connections configuration keys in rabbitmq.conf.

GitHub issue: #16407

MQTT Plugin

Bug Fixes

The MQTT connection process no longer fails and logs an exception when keepalive checks encounter socket errors on
an already-closed connection.

GitHub issue: #16391

Enhancements

It is now possible to cap the maximum number of concurrent MQTT client connections using the mqtt.max_connections
configuration key in rabbitmq.conf.

GitHub issue: #16367

Federation Plugin

Bug Fixes

Federation links could fail to start during rolling cluster restarts.

GitHub issues: #16234, #16224

LDAP Plugin

Enhancements

New rabbitmq.conf configuration settings for TLS cipher suites: auth_ldap.ssl_options.ciphers.*.

GitHub issue: #16226

HTTP Auth Backend Plugin

Enhancements

New rabbitmq.conf configuration settings for TLS cipher suites: auth_http.ssl_options.ciphers.*.

GitHub issue: #16226

Auth Backend Cache Plugin

Bug Fixes

The cache was not effective for reconnecting clients.

GitHub issues: #16255, #16258

Trust Store Plugin

Bug Fixes

A user-provided fail_if_no_peer_cert value in the plugin's TLS options is now respected. Previously,
an internal default could override the configured value.

GitHub issue: #16201

Enhancements

New rabbitmq.conf configuration settings for TLS cipher suites: trust_store.ssl_options.ciphers.*.

GitHub issue: #16226

Dependency Changes

ra was upgraded to 2.17.3
cuttlefish was upgraded to 3.7.0
cowboy was upgraded to 2.15.0
cowlib was upgraded to 2.16.1
gun was upgraded to 2.3.0

RabbitMQ 4.3.0

2026-05-12T00:30:06Z

RabbitMQ 4.3.0 is a new feature release.

Breaking Changes and Compatibility Notes

Mnesia and Parition Handling Strategies are Removed

Since only 4.2.x clusters can upgrade to 4.3.0 in place, this
won't be a breaking change for nearly all instalations but it will affect community
plugins that use Mnesia.

All partition handling-related keys in rabbitmq.conf will be
accepted by 4.3.0 nodes but won't have any effect:

cluster_partition_handling
cluster_partition_handling.pause_if_all_down.recover
cluster_partition_handling.pause_if_all_down.nodes.$name

Team RabbitMQ recommends removing the above keys from rabbitmq.conf before or shortly after upgrading.

Deprecated Features are Now Disabled by Default

A number of deprecated features are now disabled
by default and require the user to opt-in in order to use them.

This includes non-durable (transient) non-exclusive queues:
attempts to declare a queue with such property combination will be rejected by default.
Use durable queues, transient exclusive queues, or durable queues with a queue TTL instead.

To explicitly allow transient non-exclusive queues, make sure that
all nodes in the cluster include the following rabbitmq.conf key
and were restarted so that all nodes have a consistent view of the deprecated
feature settings:

# Enables deprecated non-durable (transient) non-exclusive queues
# (disabled by default as of RabbitMQ `4.3.0`, will be removed in a later version).
#
# Must be effective on all cluster nodes BEFORE
# the cluster is upgraded to `4.3.0`.
# If only some nodes have the setting configured, it will not have the desired effect.
deprecated_features.permit.transient_nonexcl_queues = true

If only some nodes have setting configured, it will not have the desired effect.

Classic Queues v1 Storage (CQv1) is Removed

This release removes the original classic queue storage implementation these days
known as CQv1. A 2nd generation implementation called CQv2 has been adopted
as the default starting with 4.2.0.

This means that attempts to declare a queue using the following optional queue arguments will fail:

x-queue-mode set to any value
x-queue-version set to 1

Existing classic queues upgraded to CQv2 during an earlier upgrade to 4.2.x will continue
operating as usual.

Consumer Timeouts are No Longer Evaluated for Classic Queues and Streams

This release moves consumer timeout handling responsibility into the queues
themselves. Also, all protocols (except for the stream protocol) now evaluate
consumer timeout for queue types that support them. Classic queues and streams
never evaluate consumer timeouts as their use cases largely avoid the need for
such as feature.

Release Highlights

Khepri is Now The Only Metadata Store

As of this release, Khepri is the only metadata store supported
by RabbitMQ: Mnesia was removed completely.

In practical operational terms, this means that

For a cluster to be available, a majority of nodes must be online at all times
Failure and partition recovery in a RabbitMQ cluster is now significantly
simpler and uniform: all components that have replicated state (Khepri, quorum queues, streams)
recover per Raft recovery semantics

Quorum Queues Enhancements

This release upgrades the Ra dependency to 3.x and introduces
a new (8th) version of the quorum queue state machine with several new features and optimisations:

Strict priority queues with per-priority message counts, correct
redelivery ordering, and priority-aware message expiration
Delayed retry for quorum queues: configurable increasing backoff when
messages are returned
Consumer timeout for quorum queues: configurable timeout for
unacknowledged messages, with protocol-specific handling for AMQP 1.0 and
MQTT
Recovery snapshots and snapshot throttling to reduce recovery time
and improve snapshotting decisions
Memory optimisations including compact message references, optimised
tuple storage for delayed keys, and removal of rabbit_fifo_index usage

Upgrading to 4.3.0

Documentation Guides on Upgrades

See the Upgrading guide for documentation on upgrades and GitHub releases
for release notes of individual releases.

This release series supports upgrades from 4.2.x. Upgrades from earlier series are not supported:
users must upgrade to the latest available 4.2.x patch release before upgrading to 4.3.0.

New Required Feature Flags

All feature flags introduced in 4.2.0 and earlier are required, including the following:

rabbitmq_4.2.0
rabbitmq_4.1.0
rabbitmq_4.0.0
khepri_db
quorum_queue_non_voters
message_containers_deaths_v2

Enable all required feature flags before upgrading to 4.3.0.

If your RabbitMQ cluster had plugin rabbitmq_amqp1_0 enabled in RabbitMQ 3.13.x (and your cluster still serves AMQP 1.0 client connections in 4.x), your cluster should do at least one rolling update after enabling feature flag rabbitmq_4.0.0 but before upgrading to 4.3.0.

Deprecated Features

In 4.3.0 the deprecation phase of the following features advanced from permitted_by_default to denied_by_default:

amqp_address_v1
amqp_filter_set_bug
global_qos
queue_master_locator
transient_nonexcl_queues

And the deprecated feature ram_node_type has been removed.

Mixed Version Cluster Compatibility

RabbitMQ 4.3.0 nodes can run alongside 4.2.x in the same cluster.

Mixed version clusters are a mechanism that allows rolling upgrades and are not meant to be run for extended
periods of time (no more than a few hours).

Changes Worth Mentioning

Core Server

Enhancements

When a message is rejected by a queue, RabbitMQ now provides the queue name and rejection reason to AMQP 1.0 publishers
in the Rejected outcome. This is particularly useful when multiple queues are bound to an exchange, as it allows
publishers to identify which specific queue out of several target queues rejected the message and why
(e.g., maximum queue length reached or queue unavailable). Previously, publishers had no way to determine which queue
rejected their message or the reason for rejection.

The queue name and reason are included in the info field of the Rejected outcome's error field:
- queue: <queue name>
- reason: maxlen | unavailable
GitHub issue: #15075
Quorum queues now support strict priority queues with per-priority message counts,
correct redelivery ordering across priorities, and priority-aware message expiration scans.

GitHub issue: #13885
Quorum queues now support delayed retry with configurable backoff based on delivery count. When messages
are returned (via reject, nack, or modify), they can be held in a delayed state before becoming
available again. The delay is based on delivery count: min(min_delay * delivery_count, max_delay).

Configuration is available via queue arguments (x-delayed-retry-type, x-delayed-retry-min,
x-delayed-retry-max) or policy keys (delayed-retry-type, delayed-retry-min,
delayed-retry-max). The retry type can be set to disabled, all, failed, or returned.

GitHub issue: #13885
Quorum queues now support a configurable consumer timeout. When a consumer holds unacknowledged
messages beyond the timeout, the messages are returned to the queue. For AMQP 1.0 clients,
timed-out deliveries are released via DISPOSITION(state=released) instead of detaching the link,
allowing the consumer to recover without re-attaching. MQTT consumers are also supported.

The timeout can be set via the x-consumer-timeout consumer argument, queue argument, consumer-timeout
policy key, or the global consumer_timeout setting in rabbitmq.conf.

GitHub issue: #13885
A new consumer_disconnected_timeout setting controls how long quorum queues wait before returning
messages when a consumer's node becomes unreachable due to a network partition. The default is 60 seconds.
Configurable via consumer_disconnected_timeout in rabbitmq.conf, the consumer-disconnected-timeout
policy key, or the x-consumer-disconnected-timeout queue argument.

GitHub issue: #13885
Quorum queue recovery snapshots reduce recovery time after a member restart by avoiding
the need to replay all enqueue commands from the log.

GitHub issue: #13885
Quorum queue snapshot throttling now uses WAL fill ratio and reclaimable byte tracking
to make smarter snapshotting decisions, yielding roughly one snapshot per queue per WAL cycle
instead of excessive snapshots in shallow, fast-flowing queues.

GitHub issue: #13885
Quorum queue memory optimisations: message references now use a compact packed integer
representation ("compact" means up to 59-bit) when possible, halving per-message
memory overhead in many scenarios. The rabbit_fifo_index module is no longer used by the
main state machine.

GitHub issue: #13885
Quorum queues now allow unlimited explicit message returns. The delivery limit is based on
delivery-count rather than acquired-count, so messages can be explicitly returned to the
queue without counting towards the delivery limit.

GitHub issue: #13885
The x-modulus-hash exchange type, previously provided by the sharding plugin, was moved
into the core and reworked to provide stable message routing (distribution)
assuming a stable set of bindings, including between node restarts.

GitHub issue: #15849
When quorum queue members (replicas) are deleted from a node, either manually
via rabbitmq-queues shrink or as part of rabbitmqctl forget_cluster_node,
the members are stopped in parallel.

GitHub issue: #15081
Purging a quorum queue now also removes at-least-once dead-lettered messages that were pending delivery.

GitHub issue: #13885
AMQP 0-9-1: when a connection's credentials are refreshed, the permissions cache is now
cleared and consumer permissions are re-validated immediately

GitHub issue: #16092
Quorum queue delivery limit can now be changed via policy without queue redeclaration

GitHub issue: #16035
Khepri topic exchange routing projection (v4): replaced the internal representation with a trie
backed by an ordered_set ETS table, significantly improving routing performance
for topic exchanges with many bindings

GitHub issue: #15619
Quorum queues notify AMQP 1.0 clients of Single Active Consumer state changes

GitHub issue: #15736
More rabbitmq.conf keys now accept tagged values (e.g., encrypted:...)

GitHub issue: #15808
Startup banner no longer includes the Erlang cookie hash

GitHub issue: #16087
Optimised AMQP 1.0 message container annotation handling during modify outcomes

GitHub issue: #15743
Bulk queue delete with Khepri has been optimized

GitHub issue: #14902
Optimised quorum queue message expiry scanning

GitHub issue: #15846
AMQP 0-9-1: configure permission checks now apply to passive queue and exchange declarations,
matching the behavior of their regular counterparts

GitHub issue: #16085
Khepri snapshot interval is now configurable in rabbitmq.conf

GitHub issue: #16011
Quorum queue Raft settings: additional configuration settings are now exposed in rabbitmq.conf,
including maximum segment size

GitHub issue: #15962

Bug Fixes

If a quorum queue with a large backlog terminated abnormally, node memory
footprint could spike.

GitHub issue: #15837
rabbitmqctl forget_cluster_node now removes all quorum queue and stream members (replicas)
before proceeding to leave the metadata store cluster.

This order minimizes the risk of some replicas being left behind on the leaving node.

GitHub issue: #15729
Quorum queue at-most-once dead lettering for the overflow behaviour drop-head now happens in the correct order.

GitHub issue: #14926
Feature flag state in the registry and on disk were not consistent for a period of time during node boot.

GitHub issue: #14943
Classic queues now implement AMQP 1.0 delivery-count and first-acquirer headers properly.

GitHub issue: #15020
Quorum queues returned an incorrect consumer count in the response to a passive
queue.declare operation

GitHub issue: #16185
Classic queue shared store could leave stale index entries after segment removal or rollover,
causing unnecessary disk space usage

GitHub issue: #16142
Bindings targeting Direct Reply-to pseudo-queues are now rejected instead of
being silently accepted without any functional effect

GitHub issue: #15935
AMQP 1.0 sessions could grant too many credits in certain failure and recovery scenarios

GitHub issue: #15883
Quorum queues: acquired-count is now correctly preserved when dead-lettering

GitHub issue: #16039
AMQP 1.0: attaching with a link handle already in use on the same session is now rejected
with a handle-in-use session error, as required by the specification

GitHub issue: #16039
Quorum queues: Single Active Consumer could incorrectly report multiple active consumers
in certain timing scenarios

GitHub issue: #15733
Quorum queues: consumer timeout could fail to trigger under certain conditions

GitHub issue: #15805
The channel limit exceeded error message now correctly identifies the per-user limit
as the source of the constraint

GitHub issue: #15750

Stream Plugin

Bug Fixes

stream.read_ahead is a new setting that controls how much data is prefetched from disk
for stream reads (consumption).

GitHub issue: #14948
Stream deletion is now more resilient and can handle certain mid-deletion failure scenarios.

GitHub issue: #14852
new_stream coordinator command is now idempotent. Previously, concurrent or retried
stream declarations could produce spurious errors even though the stream was created
successfully

GitHub issue: #15706

Prometheus Plugin

Enhancements

/metrics/detailed endpoint now supports filtering queue metrics by queue name

GitHub issue: #15689

Grafana Dashboards

Enhancements

The dashboards were updated for the most recent RabbitMQ release series.
Replaced explicit rate intervals with $__rate_interval for better
compatibility across different scrape intervals

GitHub issue: #15978

Management Plugin

Enhancements

GET /api/queues/{vhost} requests no longer perform unnecessary virtual host permission checks
and log less (at debug level) as a result.

GitHub issue: #14923
Quorum queue delayed retry configuration and status, per-priority message counts, and consumer
timeout state are now displayed in the management UI.

GitHub issue: #13885
GET /users/{user}/queues has been added.

GitHub issue: #15074
HTTP API displays static connection info (peer address, TLS details, auth mechanism)
even when stats collection is disabled via rabbitmq.conf

GitHub issue: #16009

Bug Fixes

effective_policy_definition in HTTP API responses now returns an empty JSON object
(not an array or empty string) when no policy applies to a queue

GitHub issue: #16017
Management UI: OAuth 2 used side by side with Basic Auth could fail to reload provider
configuration correctly

GitHub issue: #15793
Management UI: preference cookie expiry now respects the configured session timeout
setting rather than using a hardcoded value

GitHub issue: #15814
Management UI: users were presented with a 401 error after changing their own password
via the UI. The session is now refreshed automatically

GitHub issue: #15730
The deprecated, unused GET /api/auth endpoint was removed.

It has been out of use since 3.11 but never removed.

GitHub issue: #16083
POST /api/users/bulk-delete now respects the protected_users configuration,
matching the behavior of the single-user DELETE /api/users/:name endpoint

GitHub issue: #16143

MQTT Plugin

Enhancements

For MQTT 5.0 publishers, when a message is rejected because the target queue's maximum length is exceeded,
RabbitMQ now returns a Quota exceeded reason code in the PUBACK packet. This provides publishers with
actionable information about why their message was rejected.

GitHub issue: #15075
MQTT QoS 0 queue type now reports member information in management API responses

GitHub issue: #15656

Web MQTT Plugin

Enhancements

A default max_frame_size is now set on WebSocket connections, bounding decompressed frame sizes.
The limit starts at mqtt.max_packet_size_unauthenticated and is raised after successful CONNECT

GitHub issue: #16180
A login_timeout is now enforced for WebSocket connections, matching the TCP listener behavior

GitHub issue: #16120
WebSocket Origin header will be validated web_mqtt.allow_origins

GitHub issue: #16158

STOMP Plugin

Enhancements

For certain destinations that previously used non-durable (transient) queues,
STOMP subscriptions now use exclusive queues, as non-exclusive transient queues
are a deprecated property combination disabled by default as of this release

GitHub issue: #13016

Web STOMP Plugin

Enhancements

WebSocket Origin header validation is now available via web_stomp.allow_origins

GitHub issue: #16158

Federation Plugin

Enhancements

Federation links and their connections are now stopped in parallel.

This significantly improves shutdown time for nodes with many (into thousands) federation links.

GitHub issue: #15271
Federation links no longer restart during plugin or node shutdown.

For nodes with hundreds or thousands of federation links, link recovery could
significantly delay node shutdown.

GitHub issue: #15258

Federation Management Plugin

Bug Fixes

Federation link restart operations now require the policymaker tag

GitHub issue: #16051

Shovel Plugin

Enhancements

An optional src-consumer-name property can be specified to define the consumer tag
(amqp091 and local src-protocol) or link identifier (amqp10 protocol)

Bug Fixes

Improved target node resource alarm handling for AMQP 1.0 and local shovels.

GitHub issue: #14886
Local shovels could run into an exception that would cause a shovel restart.

GitHub issue: #14872
AMQP 1.0 shovels ignored the sasl URI parameter.

GitHub issue: #14867

Shovel Management Plugin

Bug Fixes

Shovel management: DELETE operations now require the policymaker tag, matching the
federation plugin counterpart

GitHub issue: #16051

OAuth 2 Plugin

Bug Fixes

A usability improvement allows the plugin to automatically load the trusted system x.509 (TLS) certificates.

GitHub issue: #14927
The auth cache backend now correctly delegates token expiry timestamps to the wrapped backend,
ensuring connections are closed when tokens expire

GitHub issue: #16100

LDAP Plugin

Enhancements

LDAP queries, including multi-line ones, can now be specified in rabbitmq.conf.

GitHub issue: #14868

Bug Fixes

A usability improvement allows the plugin to automatically load the trusted system certificates
when the user only enables TLS for the LDAP client but does not configure any other settings.

GitHub issue: #14937
DN values are now handled per RFC 4514

GitHub issue: #16101

HTTP Auth Backend Plugin

Enhancements

The HTTP Auth Backend can now optionally provide a custom authorization denial reason to AMQP clients.

To opt in, return deny <Reason> (instead of only deny) in the HTTP response body of your HTTP auth backend and set the following in your rabbitmq.conf file:

auth_http.authorization_failure_disclosure = true

See the README for more information.

GitHub issue: #14641

Sharding Plugin

Enhancements

The x-modulus-hash exchange type, previously provided by the sharding plugin, was moved
into the core and reworked to provide stable message routing (distribution)
assuming a stable set of bindings, including between node restarts.

GitHub issue: #15849

Trust Store Plugin

Enhancements

Refactored certificate identification to avoid (unlikely) conflicts

GitHub issue: #16116
The plugin now provides CLI commands for trust store certificate management have been introduced

GitHub issue: #15746
Rejected certificates are now logged with additional diagnostic details

GitHub issue: #15889

Tracing Plugin

Bug Fixes

Trace file downloads now set the charset to UTF-8 when serving trace files.

GitHub issue: #13952

Dependency Changes

ra was upgraded to 3.1.6
khepri was upgraded to 0.18.0
osiris was upgraded to 1.3.1
gen_batch_server was upgraded to 0.9.2
cuttlefish was upgraded to 3.6.0

Source Code Archives

To obtain source code of the entire distribution, please download the archive named rabbitmq-server-4.3.0.tar.xz
instead of the source tarball produced by GitHub.