[AutoPR- Security] Patch rabbitmq-server for CVE-2026-43973 [MEDIUM] (microsoft#17747)

Co-authored-by: BinduSri-6522866 <v-badabala@microsoft.com>

Author: azurelinux-security

SPECS/rabbitmq-server/CVE-2026-43973.patch

@@ -0,0 +1,112 @@
+From f3e7e0568b3c4cf9fa4bea79d5116e67ce76ad25 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Lo=C3=AFc=20Hoguin?= <essen@ninenines.eu>
+Date: Thu, 4 Jun 2026 14:47:13 +0200
+Subject: [PATCH] Add max_{header|trailer}_block_size HTTP/1.1 options
+
+Upstream Patch reference: https://github.com/ninenines/gun/commit/f3e7e0568b3c4cf9fa4bea79d5116e67ce76ad25.patch
+---
+ deps/gun/src/gun.erl      |  2 ++
+ deps/gun/src/gun_http.erl | 40 +++++++++++++++++++++++++++++++++------
+ 2 files changed, 36 insertions(+), 6 deletions(-)
+
+diff --git a/deps/gun/src/gun.erl b/deps/gun/src/gun.erl
+index 1659ee3..b2e2196 100644
+--- a/deps/gun/src/gun.erl
++++ b/deps/gun/src/gun.erl
+@@ -144,6 +144,8 @@
+ 
+ -type http_opts() :: #{
+ 	keepalive             => timeout(),
++	max_header_block_size => non_neg_integer(),
++	max_trailer_block_size => non_neg_integer(),
+ 	transform_header_name => fun((binary()) -> binary()),
+ 	version               => 'HTTP/1.1' | 'HTTP/1.0'
+ }.
+diff --git a/deps/gun/src/gun_http.erl b/deps/gun/src/gun_http.erl
+index abd4fc5..51f6f46 100644
+--- a/deps/gun/src/gun_http.erl
++++ b/deps/gun/src/gun_http.erl
+@@ -56,7 +56,9 @@
+ 	in = head :: io(),
+ 	in_state = {0, 0} :: {non_neg_integer(), non_neg_integer()},
+ 	out = head :: io(),
+-	transform_header_name :: fun((binary()) -> binary())
++	transform_header_name :: fun((binary()) -> binary()),
++	max_header_block_size = 100000 :: non_neg_integer(),
++	max_trailer_block_size = 10000 :: non_neg_integer()
+ }).
+ 
+ check_options(Opts) ->
+@@ -73,6 +75,10 @@ do_check_options([{keepalive, infinity}|Opts]) ->
+ 	do_check_options(Opts);
+ do_check_options([{keepalive, K}|Opts]) when is_integer(K), K > 0 ->
+ 	do_check_options(Opts);
++do_check_options([{max_header_block_size, M}|Opts]) when is_integer(M), M > 0 ->
++	do_check_options(Opts);
++do_check_options([{max_trailer_block_size, M}|Opts]) when is_integer(M), M > 0 ->
++	do_check_options(Opts);
+ do_check_options([{transform_header_name, F}|Opts]) when is_function(F) ->
+ 	do_check_options(Opts);
+ do_check_options([{version, V}|Opts]) when V =:= 'HTTP/1.1'; V =:= 'HTTP/1.0' ->
+@@ -86,8 +92,11 @@ init(Owner, Socket, Transport, Opts) ->
+ 	Version = maps:get(version, Opts, 'HTTP/1.1'),
+ 	Handlers = maps:get(content_handlers, Opts, [gun_data_h]),
+ 	TransformHeaderName = maps:get(transform_header_name, Opts, fun (N) -> N end),
++	MaxHeaderBlockSize = maps:get(max_header_block_size, Opts, 100000),
++	MaxTrailerBlockSize = maps:get(max_trailer_block_size, Opts, 10000),
+ 	#http_state{owner=Owner, socket=Socket, transport=Transport, version=Version,
+-		content_handlers=Handlers, transform_header_name=TransformHeaderName}.
++		content_handlers=Handlers, transform_header_name=TransformHeaderName,
++	        max_header_block_size=MaxHeaderBlockSize, max_trailer_block_size=MaxTrailerBlockSize}.
+ 
+ %% Stop looping when we got no more data.
+ handle(<<>>, State) ->
+@@ -96,10 +105,20 @@ handle(<<>>, State) ->
+ handle(_, #http_state{streams=[]}) ->
+ 	close;
+ %% Wait for the full response headers before trying to parse them.
+-handle(Data, State=#http_state{in=head, buffer=Buffer}) ->
++handle(Data, State=#http_state{in=head, buffer=Buffer, max_header_block_size=MaxHeaderBlockSize,
++		streams=[#stream{ref=StreamRef, reply_to=ReplyTo}|_]}) ->
+ 	Data2 = << Buffer/binary, Data/binary >>,
+ 	case binary:match(Data2, <<"\r\n\r\n">>) of
+-		nomatch -> {state, State#http_state{buffer=Data2}};
++		nomatch ->
++			case byte_size(Data2) > MaxHeaderBlockSize of
++				true ->
++					Reason = {connection_error, limit_reached,
++						"The response header block is too large."},
++					gun:reply(ReplyTo, {gun_error, self(), Reason}),
++					{error, Reason};
++				false ->
++					{state, State#http_state{buffer=Data2}}
++			end;
+ 		{_, _} -> handle_head(Data2, State#http_state{buffer= <<>>})
+ 	end;
+ %% Everything sent to the socket until it closes is part of the response body.
+@@ -156,11 +175,20 @@ handle(Data, State=#http_state{in=body_chunked, in_state=InState,
+ 					close
+ 			end
+ 	end;
+-handle(Data, State=#http_state{in=body_trailer, buffer=Buffer, connection=Conn,
++handle(Data, State=#http_state{in=body_trailer, buffer=Buffer, connection=Conn, max_trailer_block_size=MaxTrailerBlockSize,
+ 		streams=[#stream{ref=StreamRef, reply_to=ReplyTo}|_]}) ->
+ 	Data2 = << Buffer/binary, Data/binary >>,
+ 	case binary:match(Data2, <<"\r\n\r\n">>) of
+-		nomatch -> {state, State#http_state{buffer=Data2}};
++		nomatch ->
++			case byte_size(Data2) > MaxTrailerBlockSize of
++				true ->
++					Reason = {connection_error, limit_reached,
++						"The response trailer block is too large."},
++					gun:reply(ReplyTo, {gun_error, self(), Reason}),
++					{error, Reason};
++				false ->
++					{state, State#http_state{buffer=Data2}}
++			end;
+ 		{_, _} ->
+ 			{Trailers, Rest} = cow_http:parse_headers(Data2),
+ 			%% @todo We probably want to pass this to gun_content_handler?
+-- 
+2.43.0
+

SPECS/rabbitmq-server/rabbitmq-server.spec

@@ -2,7 +2,7 @@
 Summary:        rabbitmq-server
 Name:           rabbitmq-server
 Version:        3.13.7
-Release:        5%{?dist}
+Release:        6%{?dist}
 License:        Apache-2.0 and MPL 2.0
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -14,6 +14,7 @@ Patch1:			CVE-2025-50200.patch
 Patch2:			CVE-2026-8466.patch
 Patch3:			CVE-2026-43968.patch
 Patch4:			CVE-2026-7790.patch
+Patch5:			CVE-2026-43973.patch
 
 BuildRequires:  elixir
 BuildRequires:  erlang
@@ -70,6 +71,9 @@ done
 %{_libdir}/rabbitmq/lib/rabbitmq_server-%{version}/*
 
 %changelog
+* Wed Jun 17 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.13.7-6
+- Patch for CVE-2026-43973
+
 * Sat May 30 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.13.7-5
 - Patch for CVE-2026-7790, CVE-2026-43968