OSSEVA FOR RABBITMQ
RabbitMQ support that keeps you on real RabbitMQ. We patch, architect, and operate it.
OSSeva provides RabbitMQ support for 3.8.x through 4.3.x, including patched builds for 3.8.x to 3.13.x and 4.0.x to 4.2.x after the upstream community stops fixing them. Drop-in CVE patches come with the architecture and operations work a binary subscription does not include, and the Erlang/OTP runtime underneath.
Reply within 1 business day · No commitment · or book a 15-minute call
Which vendors provide patched RabbitMQ after end of life? Patched RabbitMQ 3.x Builds with SBOM and VEX Attestation.
Last reviewed
Trusted globally by enterprises





Why now
RabbitMQ 3.13.x: community support ended
The upstream community ended security patches for 3.13.x on 30 September 2024. Unpatched CVEs now accumulate with no official fix path. OSSeva ships patches quarterly — signed and validated.
Broadcom Tanzu is licensed by CPU core count
Tanzu RabbitMQ is licensed by CPU core count, so the bill scales with the size of the hosts rather than with the support consumed. We do not publish Broadcom's numbers — compare your renewal quote against a per-cluster model directly.
Your auditor won't accept 'community EOL'
SOC 2, HIPAA, PCI, and ISO 27001 frameworks all require evidence of continued security controls. An unsupported runtime fails that test. Our attestations are designed to be handed to your auditor without revision.
Versions covered
All versions below receive active CVE patches from OSSeva. Version numbers in monospace are exact release identifiers.
| Version | Status | Active CVEs |
|---|---|---|
| 3.8.x(CVE backports where feasible; mitigations where not) | Extended | Clean |
| 3.9.x(CVE backports + architectural guidance) | Extended | Clean |
| 3.10.x(Full CVE coverage) | Extended | Clean |
| 3.11.x | Extended | Clean |
| 3.12.x | Extended | Clean |
| 3.13.x(1 patch in test) | Extended | 1 open |
| 3.13.7 | Hardened | Clean |
| 4.0.x(Community EOL — OSSeva patched) | EOL | Clean |
| 4.1.x(Community EOL — OSSeva patched) | EOL | Clean |
| 4.2.x(Community EOL — OSSeva patched) | EOL | Clean |
| 4.3.x(Community support ends 31 Jan 2027) | Current | Clean |
Running a RabbitMQ version or build not listed here?
What you get
Three tiers — pick the level of engagement that matches your team's operational needs and compliance requirements.
OSSeva Patch
CVE remediation, signed builds, repo manager integration.
- Quarterly CVE patches for all covered versions
- Signed artifacts (GPG + Sigstore)
- Maven / Helm / private OCI repo delivery
- Vulnerability disclosure notifications
- Erlang/OTP compatibility matrix
- Architecture review
- 24/7 managed operations
OSSeva Assure
Patch plus architectural review and audit-ready documentation.
- Everything in Patch
- Annual configuration & architecture audit
- Version upgrade planning
- SOC 2 / HIPAA / PCI attestation package
- Pen-test validation summary
- Reference architecture for your deployment
- 24/7 reactive support
OSSeva Operate
Full MSP: 24/7 monitoring, 15-min SLA, named engineers.
- Everything in Assure
- 24/7 proactive monitoring & alerting
- 15-minute P1 incident response SLA
- Named senior engineer on your account
- Runbook authoring and maintenance
- Quarterly business reviews
- On-call escalation path to RabbitMQ core contributors
All tiers priced per cluster/application — not per core.
Want RabbitMQ run for you, end-of-life versions included? Read about managed RabbitMQ from OSSeva Operate.
How it installs
OSSeva artifacts arrive via your existing package infrastructure. Pull the patched version the same way you pull upstream today — just from the OSSeva registry.
helm repo add osseva https://charts.osseva.io
helm repo update
helm install rabbitmq osseva/rabbitmq \
--version 3.13.7-1 \
--namespace messaging \
--set auth.username=admin \
--set replicaCount=3Migrate from Broadcom Tanzu RabbitMQ
Tanzu RabbitMQ is licensed by CPU core count, so cost tracks cluster size rather than support consumed. Our migration playbook covers licence exit, cluster migration and runtime validation — including the Erlang/OTP release underneath, which moves with the broker.
Pricing model
OSSeva for RabbitMQ is priced per application cluster, not per core. No surprise licensing math.
Are your RabbitMQ builds a fork?
No. OSSeva patches are applied to upstream community source code. Your cluster continues to run real RabbitMQ under its open source licence, the Mozilla Public License 2.0. We are not a fork, and there is no proprietary runtime in your stack.
How do CVE patches reach my cluster?
Patches are delivered as signed OCI/Helm packages or Maven artifacts via the OSSeva artifact registry. You pull the patched version the same way you pull upstream today — just from our registry.
What Erlang/OTP versions are included?
Each OSSeva release ships with a validated, tested Erlang/OTP version. The compatibility matrix is published per release. Our Erlang/OTP builds also receive CVE patches independently of the RabbitMQ release cycle.
We're on Broadcom Tanzu RabbitMQ today. How hard is the migration?
The migration scope depends on how many Tanzu-specific configuration extensions you've used. For most Tanzu customers, the migration is a configuration change and a cluster migration, planned to avoid downtime. A fixed-price discovery engagement sizes the work before any commitment.
Does OSSeva hold the CVE remediation SLA or just ship patches?
For OSSeva Operate customers, we hold a contractual SLA on critical CVE remediation. For Patch and Assure customers, we publish a quarterly cadence with out-of-cycle patches for CVSS 9+ vulnerabilities.
Can you operate RabbitMQ on our infrastructure, not yours?
Yes. OSSeva Operate is a managed service on your infrastructure — your cloud account, your VPC, your on-prem. We provide the operations layer (monitoring, runbooks, incident response) and you retain data sovereignty.
Who provides RabbitMQ support besides Broadcom?
Broadcom sells commercial RabbitMQ through Tanzu RabbitMQ. Cloud providers run managed message broker services inside their own platforms, and third-party support companies cover the community RabbitMQ you run yourself. OSSeva is a third-party provider: one contract can cover RabbitMQ and the rest of your open source stack, community EOL versions back to 3.8.x are included, and OSSeva Operate runs as a managed service on your own infrastructure.
Does OSSeva support current RabbitMQ versions or only end-of-life ones?
Both. RabbitMQ 4.3.x, the current line, is covered alongside 3.8.x to 3.13.x on extended support and 4.0.x to 4.2.x after community EOL. Every tier includes quarterly CVE patches for all covered versions, Assure adds version upgrade planning and an annual architecture audit, and Operate adds 24/7 monitoring with a 15-minute P1 incident response SLA.
Can we get support for old or unmaintained RabbitMQ versions?
Yes, back to RabbitMQ 3.8.x. The community no longer fixes 3.8.x to 3.13.x or 4.0.x to 4.2.x, and OSSeva ships patched, signed builds for all of those lines together with the Erlang/OTP runtime underneath. Clusters on 3.7.x or earlier are older than the lines OSSeva patches: Assure plans the upgrade to a covered version, and Operate carries it out with your team.
What does RabbitMQ commercial support from OSSeva include?
Patched builds for every covered version, delivered through your own repositories, and an escalation path to RabbitMQ core contributors. Assure adds 24/7 reactive support, upgrade planning and an annual architecture audit. Operate adds proactive 24/7 monitoring, a 15-minute P1 response and managed operations on your infrastructure. OSSeva Operate patches Critical CVEs (CVSS ≥ 9.0) within 48 hours and High within 7 days.
How is OSSeva RabbitMQ support priced?
OSSeva for RabbitMQ is priced per application cluster, so the price does not change with the size of the hosts underneath. The tier you choose (Patch, Assure or Operate) sets what is included. Book a discovery call for a quote.
Does OSSeva support RabbitMQ on Kubernetes?
Yes. OSSeva delivers patched RabbitMQ builds compatible with the RabbitMQ Cluster Operator for Kubernetes, including signed Helm chart updates and OCI-compliant container images, on OpenShift, EKS, AKS, GKE and other conformant Kubernetes clusters.
Can OSSeva provide RabbitMQ compliance documentation for SOC 2 or PCI DSS audits?
Yes. OSSeva Assure includes compliance documentation specifically designed for RabbitMQ audits: CVE patch attestation letters, patch cadence evidence for PCI DSS Requirement 6.3.3, SOC 2 CC6 logical access control evidence templates, and audit narratives for HIPAA §164.312 technical safeguards.
What are RabbitMQ quorum queues, and does OSSeva support them?
Quorum queues are RabbitMQ's durable, replicated queue type built on the Raft consensus protocol. They replace classic mirrored queues for high-availability workloads. OSSeva supports quorum queue deployments across all covered RabbitMQ versions and includes quorum queue configuration in our reference architectures.
Get a quote
Ready to get RabbitMQ patched and supported?
Tell us your RabbitMQ versions and an engineer replies within 1 business day with coverage and a price. Prefer a call? It takes 15 minutes.
Prefer to talk or read more first?