RabbitMQ 4.0 end of life
RabbitMQ 4.0 left community support on 30 April 2025, and Broadcom's commercial support for 4.0 ends on 30 September 2026. The last public release was 4.0.9, published on 14 April 2025. Later fixes, including the one for CVE-2026-57213, shipped only in commercial 4.0 releases. OSSeva ships patched 4.0 builds, so clusters stay covered after the commercial date passes.
- End of life
- 30 April 2025
- Released
- Sept 2024
- Final release
- 4.0.9 (last public release)
- Successor
- RabbitMQ 4.3, via 4.2
Date published by RabbitMQ release information. We do not publish a lifecycle date we cannot source.
Last reviewed
What actually stops on 30 April 2025
- Public 4.0.x releases. 4.0.9 was the last.
- Commercial 4.0 support from Broadcom, on 30 September 2026.
- Public fixes for later advisories. CVE-2026-57213, a stored XSS in the federation management plugin published in July 2026, is fixed in 4.0.19, which is a commercial release.
What actually breaks in the upgrade
4.0 goes through 4.2 to reach 4.3
RabbitMQ's rolling-upgrade table lists 4.0.x to 4.1.x and 4.0.x to 4.2.x, but no direct path from 4.0 to 4.3. Community support for 4.2 ended on 31 July 2026, so 4.2 is a stop on the way. The only line in community support today is 4.3, and that support ends on 30 November 2026.
Erlang 27 is the ceiling
From 4.0.4 the series runs on Erlang 26.2 to 27.x, and Erlang 28 is not supported on 4.0. The runtime cannot move past OTP 27 until the broker does.
Reach 4.0.9 before anything else
Before 4.0.8, the HTTP API can write Authorization headers, which carry base64-encoded credentials, to the log when an error occurs (CVE-2025-50200). The fix is public, so any 4.0 cluster below 4.0.8 should move to 4.0.9 first, whatever the longer plan is.
Your options, costed honestly
Including the ones that do not involve buying anything from us.
| Option | What it is | Effort | Cost | Our view |
|---|---|---|---|---|
| Upgrade to RabbitMQ 4.3 | Two rolling upgrades, 4.0 to 4.2 and 4.2 to 4.3. | Weeks | Engineering time | The destination, with the caveat that 4.3 community support itself ends in November 2026. |
| Broadcom commercial support on a newer line | Broadcom lists commercial support to 30 April 2027 for 4.1 and 30 June 2030 for 4.2. | Upgrade plus procurement | Commercial subscription | Only an option after the upgrade. 4.0 itself leaves commercial support on 30 September 2026. |
| OSSeva patched builds on 4.0 | Signed 4.0 builds with fixes for advisories published after 4.0.9. | Days | Subscription | Keeps the cluster covered through and after the commercial cut-off while the move to 4.3 is planned. |
| Stay on public 4.0.9 | No public fixes since April 2025. | None | Zero now | Scanners already flag advisories fixed only in commercial 4.0 releases. |
What OSSeva does for RabbitMQ 4.0
OSSeva patches this line
OSSeva ships patched, signed RabbitMQ 4.0 builds now, with backported fixes for advisories published after 4.0.9, such as CVE-2026-57213. They keep running when Broadcom's commercial 4.0 support ends on 30 September 2026, on the Patch, Assure and Operate tiers.
RabbitMQ extended supportWhat your auditor will say
Every system component in the cardholder data environment needs its applicable security patches. A runtime or broker with no upstream fix supply needs a patched source or a documented compensating control.
Auditors ask for evidence that production systems receive security fixes. A version past end of life fails that test unless another supplier ships the fixes and can show which CVEs they close.
RabbitMQ 4.0: common questions
When does RabbitMQ 4.0 reach end of life?
Community support ended on 30 April 2025. Broadcom's commercial support for 4.0 ends on 30 September 2026. The last public release was 4.0.9, on 14 April 2025.
Can I upgrade RabbitMQ 4.0 directly to 4.3?
Not with a rolling upgrade. RabbitMQ lists 4.0.x to 4.1.x and 4.0.x to 4.2.x, and 4.2.x to 4.3.x, so the path is 4.0 to 4.2, then 4.2 to 4.3.
Which Erlang versions does RabbitMQ 4.0 support?
Erlang 26.2 to 27.x from 4.0.4 onwards, and 26.2 only for 4.0.1 to 4.0.3. Erlang 28 is not supported on 4.0.
Who patches RabbitMQ 4.0 after September 2026?
OSSeva ships patched, signed 4.0 builds today, and they continue after Broadcom's commercial support for 4.0 ends on 30 September 2026.
Still running RabbitMQ 4.0?
Tell us the versions and the estate size. We will tell you honestly whether to upgrade or to buy cover — and we say 'upgrade' more often than you would expect.