CVE-2026-66080

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0

Description An issue exists in the validate partitions() function where it only verifies that the requested partition count is at least 1, without enforcing an upper limit. An attacker with the management tag and access to the target vhost can trigger excessive memory allocation (approximately 8GB) by providing a large count, such as lists:seq(0, 500000000). This requires the rabbitmq stream management plugin to be enabled.

Recommendations Update to version 4.1.11 Update to version 4.2.6 Update to version 4.3.0 As a temporary mitigation, disable the rabbitmq stream management plugin.