[rpms/rabbitmq-server] f43: Fixed CVE-2026-44839

[rpms/rabbitmq-server] f43: Fixed CVE-2026-44839

[Peter Lemenkov]

            A new commit has been pushed.

            Repo   : rpms/rabbitmq-server
            Branch : f43
            Commit : 908d8767b915f915f876ed8af22db4e7c21a4b7e
            Author : Peter Lemenkov <lemenkov@gmail.com>
            Date   : 2026-07-23T02:04:35+02:00
            Stats  : +37/-1 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/rabbitmq-server/c/908d8767b915f915f876ed8af22db4e7c21a4b7e?branch=f43

            Log:
            Fixed CVE-2026-44839

Signed-off-by: Peter Lemenkov <lemenkov@gmail.com>

---
diff --git a/rabbitmq-server-0006-management-Sanitize-vhost-names-in-restart-forms.patch b/rabbitmq-server-0006-management-Sanitize-vhost-names-in-restart-forms.patch
new file mode 100644
index 0000000..3864240
--- /dev/null
+++ b/rabbitmq-server-0006-management-Sanitize-vhost-names-in-restart-forms.patch
@@ -0,0 +1,32 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Michael Davis <mcarsondavis@gmail.com>
+Date: Tue, 17 Jun 2025 11:54:07 -0400
+Subject: [PATCH] management: Sanitize vhost names in restart forms
+
+
+diff --git a/deps/rabbitmq_management/priv/www/js/tmpl/vhost.ejs b/deps/rabbitmq_management/priv/www/js/tmpl/vhost.ejs
+index 232fa1e501..3f15214e03 100644
+--- a/deps/rabbitmq_management/priv/www/js/tmpl/vhost.ejs
++++ b/deps/rabbitmq_management/priv/www/js/tmpl/vhost.ejs
+@@ -41,7 +41,7 @@
+             <% if (vhost.cluster_state[node] == "stopped"){ %>
+                 <form action="#/restart_vhost" method="post">
+                     <input type="hidden" name="node" value="<%= node %>"/>
+-                    <input type="hidden" name="vhost" value="<%= vhost.name %>"/>
++                    <input type="hidden" name="vhost" value="<%= fmt_string(vhost.name) %>"/>
+                     <input type="submit" value="Restart"/>
+                 </form>
+             <% } %>
+diff --git a/deps/rabbitmq_management/priv/www/js/tmpl/vhosts.ejs b/deps/rabbitmq_management/priv/www/js/tmpl/vhosts.ejs
+index c3dacaad7c..5880b06d70 100644
+--- a/deps/rabbitmq_management/priv/www/js/tmpl/vhosts.ejs
++++ b/deps/rabbitmq_management/priv/www/js/tmpl/vhosts.ejs
+@@ -92,7 +92,7 @@
+             <% if (state == "stopped"){ %>
+                 <form action="#/restart_vhost" method="post" class="confirm">
+                     <input type="hidden" name="node" value="<%= node %>"/>
+-                    <input type="hidden" name="vhost" value="<%= vhost.name %>"/>
++                    <input type="hidden" name="vhost" value="<%= fmt_string(vhost.name) %>"/>
+                     <input type="submit" value="Restart"/>
+                 </form>
+             <% } %>

diff --git a/rabbitmq-server.spec b/rabbitmq-server.spec
index 6cb119c..1d78241 100644
--- a/rabbitmq-server.spec
+++ b/rabbitmq-server.spec
@@ -7,7 +7,7 @@
 
 Name: rabbitmq-server
 Version: 4.0.9
-Release: 3%{?dist}
+Release: 4%{?dist}
 License: MPL-2.0
 Source0: https://github.com/rabbitmq/rabbitmq-server/releases/download/v%{version}/%{name}_%{version}.orig.tar.xz
 Source1: https://github.com/rabbitmq/rabbitmq-server/releases/download/v%{version}/%{name}_%{version}.orig.tar.xz.asc
@@ -22,6 +22,7 @@ Patch2: rabbitmq-server-0002-Use-proto_dist-from-command-line.patch
 Patch3: rabbitmq-server-0003-force-python3.patch
 Patch4: rabbitmq-server-0004-Greatly-simplified-wrapper-script-which-works-proper.patch
 Patch5: rabbitmq-server-0005-Allow-Elixir-1.19.patch
+Patch6: rabbitmq-server-0006-management-Sanitize-vhost-names-in-restart-forms.patch
 
 URL: https://www.rabbitmq.com/
 BuildRequires: elixir
@@ -179,6 +180,9 @@ rm -f %{_rabbit_libdir}/lib/rabbitmq_server-%{version}/ebin/rabbit.{rel,script,b
 
 
 %changelog
+* Thu Jul 23 2026 Peter Lemenkov <lemenkov@gmail.com> - 4.0.9-4
+- Fixed CVE-2026-44839
+
 * Mon Apr 27 2026 Tobias Urdin <tobias.urdin@gmail.com> - 4.0.9-3
 - Update logrotate config