Denial of Service Vulnerability in RabbitMQ by Pivotal Software
CVE-2026-66074
6MEDIUM
What is CVE-2026-66074?
RabbitMQ, a messaging and streaming broker, has a vulnerability where the user-supplied regular expression in the match_value/3 function executes without a match_limit option. This can result in excessive CPU consumption, particularly with large resource sets, leading to service slowdowns and potential outages. Any user with the management tag can exploit this through normal API usage. It is crucial to upgrade to the fixed versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 to mitigate the risks associated with this vulnerability.
Affected Version(s)
rabbitmq-server >= 3.13.0, < 3.13.15 < 3.13.0, 3.13.15
rabbitmq-server >= 4.0.0, < 4.0.20 < 4.0.0, 4.0.20
rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11