The broker can't move without recertifying the device
A certified device can't absorb a broker upgrade -- recertification is its own multi-month project. The CVE fix has to land on the certified version, documented for the next audit cycle.
Challenge
A messaging broker inside a certified medical device is part of what was certified. Changing its version means requalifying the device itself, so "just upgrade RabbitMQ" is not a sentence that survives contact with regulatory affairs.
Environment
RabbitMQ embedded in a certified medical device or the platform behind one, where the broker version is fixed by the certification.
Approach
The fix is backported onto the certified version, with documentation formatted for the device's existing audit trail rather than requiring a new certification cycle.
What this delivers
CVE coverage on the certified version, with patch documentation the next audit cycle can absorb without reopening the certification itself.