PT-2026-98917 · Vmware+1 · Rabbitmq+1
CVE-2026-67408
·
Published
2026-09-25
·
Updated
2026-09-25
CVSS v4.0
7.1
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
RabbitMQ versions 4.1.0 through 4.1.10
RabbitMQ versions 4.2.0 through 4.2.8
RabbitMQ versions 4.3.0 through 4.3.2
Description
An authenticated low-privileged management user with vhost access can cause a denial of service on a memory-limited node. The issue occurs when the
rabbitmqstreammanagement plugin is enabled and the user sends a PUT request to the '/api/stream/super-streams/{vhost}/{name}' endpoint. If the request body includes the binding-keys field, the system parses the comma-separated string and allocates memory to build the stream-name list before verifying if the user has the necessary permissions to configure the streams. This allows an attacker to force large transient memory allocations, potentially crashing the container.Recommendations
Update to version 4.1.11
Update to version 4.2.9
Update to version 4.3.3
Exploit
Fix
DoS
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Rabbitmq
Rabbitmq Stream Management