CVE-2026-67416

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.0.0 through 4.0.23 RabbitMQ versions 4.1.0 through 4.1.14 RabbitMQ versions 4.2.0 through 4.2.9 RabbitMQ versions 4.3.0 through 4.3.3

Description The optimized AMQP 1.0 server mode parser in deps/amqp10 common/src/amqp10 binary parser.erl matches textual prefixes of symbolic data, sequence, and value body descriptors without verifying encoded symbol lengths. An authenticated AMQP 1.0 publisher with write permissions can submit a well-formed unknown descriptor starting with a registered body descriptor, causing the system to misclassify and store the bytes as a standard body section. This can lead to strict AMQP 1.0 consumers terminating during decoding. Additionally, for bodies misclassified as data, AMQP 0-9-1 or other cross-protocol conversions performing full body decoding may terminate the consumer protocol process, which can be repeated if delivery requires acknowledgement. Sequence and value classifications are typically transported as opaque encoded payloads during this conversion. The broker remains operational, and routing or authorization is not bypassed.

Recommendations Update to version 4.0.24 Update to version 4.1.15 Update to version 4.2.10 Update to version 4.3.4