CVE-2026-67219

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0

Description An issue exists where the add binding/3 function parses the routing key as an integer weight N and computes ring positions using lists:seq(NextN0, NextN0 + N - 1). Because the validate binding/2 function only verifies that N is greater than or equal to 1 without an upper bound, a user with write permissions on a consistent-hash exchange and read permissions on a queue can specify an arbitrarily large integer for the routing key. This causes the broker to allocate a massive list of integers via lists:seq/2 and persist it to the Khepri record across all cluster nodes, which persists through restarts. For example, a weight of 100000000 can allocate approximately 800 MB on every node. This requires the rabbitmq consistent hash exchange plugin to be enabled.

Recommendations Update to version 3.13.15. Update to version 4.0.20. Update to version 4.1.11. Update to version 4.2.6. Update to version 4.3.0. As a temporary mitigation, restrict write permissions on consistent-hash exchanges or disable the rabbitmq consistent hash exchange plugin.