PT-2026-114246 · Git+1 · Rabbitmq-Server
CVE-2026-67414
·
Published
2026-10-14
·
Updated
2026-10-14
CVSS v4.0
6.0
Medium
| Vector | AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
RabbitMQ versions 4.0.0 through 4.0.23
RabbitMQ versions 4.1.0 through 4.1.14
RabbitMQ versions 4.2.0 through 4.2.9
RabbitMQ versions 4.3.0 through 4.3.3
Description
An issue exists where the
amqp10 binary parser.erl file materializes each element of AMQP 1.0 arrays with a zero-width shared constructor. While the number of elements per array is limited, the aggregate number of arrays within a frame is not. A low-privilege client, after completing SASL authentication, can send a frame containing numerous permitted arrays. This causes a small frame to expand into a very large reader-process heap before validation or authorization occurs. Because the rabbit amqp reader.erl file clears the max heap size guard after login, repeated or concurrent frames can exhaust broker memory, block publishers, or trigger a node-wide memory alarm.Recommendations
Update to version 4.0.24
Update to version 4.1.15
Update to version 4.2.10
Update to version 4.3.4
Exploit
Fix
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Rabbitmq-Server