Handle.exe Vulnerable Driver on RabbitMQ Windows Installations

Products

• Support Only for OpenSource RabbitMQ
• RabbitMQ

Issue/Introduction

RabbitMQ on Windows installations uses a Windows sysinternals tool, handle.exe, for monitoring file and socket handle metrics. It has been reported that handle.exe creates a driver for monitoring, called PROCEXP152.SYS, that may be flagged as vulnerable by security tools.

File and socket metrics are visible on the Management UI in the Overview tab as well as select CLI output.

Management UI Overview:

CLI output like rabbitmqctl status:

File Descriptors

Total: 0, limit: 2463
Sockets: 0, limit: 2214

Environment

RabbitMQ on Windows

Cause

Handle.exe development ceased after the Oct 2022 version 5 release, and vulnerabilities may occur since this tool is no longer maintained.

Resolution

If you run into issues with handle.exe, you have the following options:

1. Upgrade: It is recommended to upgrade handle.exe to version 5, and is required on Windows Server 2025: https://learn.microsoft.com/en-us/sysinternals/downloads/handle.
2. Uninstall: If you are already on handle.exe version 5 and it's getting flagged by security tools, you can safely remove handle.exe without negatively affecting RabbitMQ operations, as it is strictly used for metrics and optional: https://www.rabbitmq.com/docs/install-windows#handle-exe.

Handle.exe Removal Disclaimer

 

To confirm, it is safe to remove handle.exe. RabbitMQ will continue to operate normally, but you may notice errors in logging and you'll want to ensure your file handle limit is set appropriately.

RabbitMQ will log the following error that can be safely ignored:

2026-01-01 12:13:14.123 [error] <0.1234.0> Could not find handle.exe, please install from sysinternals

 

Check RabbitMQ File Handle Limit

 

Without handle.exe, file/socket handle metrics will no longer be tracked and file descriptor alarms will not be triggered if these limits are breached. This can potentially lead to node crashes as discussed here: https://knowledge.broadcom.com/external/article?articleNumber=297356.

RabbitMQ uses an environment variable, ERL_MAX_PORTS , to limit file handles per node: https://www.rabbitmq.com/docs/networking#open-file-handle-limit.

You can check your current value with the following command:

rabbitmqctl eval 'erlang:system_info(port_limit).'

 

When sizing this setting, we recommend 1.5 times the expected connections per node.

Replacement & External Monitoring

 

A replacement tool is being developed (https://github.com/rabbitmq/rabbitmq-server/issues/12369), but currently there is no alternative. If you need to remove handle.exe due to security concerns, these OS level limits can be monitored externally with tools like Prometheus, Windows Exporter, WMI, or Datadog.

Please engage Tanzu support to review your specific case if you have any concerns.