CVE-2026-67240

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.2.7 RabbitMQ versions prior to 4.3.1

Description An authenticated AMQP 1.0 consumer with read and write permissions on a stream queue can cause significant CPU amplification through backtracking. This occurs because the pattern to regex function maps % to .*? and to ., then compiles the expression without an explicit match limit. A crafted LIKE filter containing overlapping lazy quantifiers can result in approximately 100-200 ms of CPU usage per delivered message. The issue is triggered when SQL filters are accepted at rabbit amqp session.erl:3264 and evaluated per-message at rabbit stream queue.erl:1439. This can be exploited by attaching a receiver with a filter and publishing messages with long property values.

Recommendations Update RabbitMQ to version 4.2.7 or later. Update RabbitMQ to version 4.3.1 or later.