CVE-2026-67242

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2

Description An issue exists in the OAuth2 implementation where token expiry checks are skipped if the Identity Provider (IdP) emits the exp claim as a JSON float. This occurs because the validatetokenexpiry/1 and expirytimestamp/1 functions use a guard that only processes integer values, causing float values to be ignored. Consequently, the login-time expiry check and the mid-connection disconnect timer are bypassed, allowing previously valid but expired signed tokens to be accepted and preventing connections from timing out.

Recommendations Update to version 4.2.9. Update to version 4.3.3.