Remote Code Execution Vulnerability in RabbitMQ Messaging Broker
CVE-2026-66079

8.2HIGH

Key Information:

Vendor

RabbitMQ

Status
RabbitMQ-server
Vendor
CVE Published:
23 September 2026

What is CVE-2026-66079?

A vulnerability exists in RabbitMQ's handling of AMQP 1.0 frames, where a malformed frame can lead to significant heap memory exhaustion. An unauthenticated attacker can exploit this by sending a single specially crafted ~19-byte frame to the AMQP listener (default port 5672), which results in the server attempting to build an enormous list of empty elements. This flaw causes the Erlang VM to exhaust its heap memory, effectively crashing the RabbitMQ node and affecting all tenants and protocols running on it. To mitigate this risk, it is essential to upgrade to the patched versions (3.13.15, 4.0.20, 4.1.11, or 4.2.6) without delay.

Affected Version(s)

rabbitmq-server >= 3.13.0, < 3.13.15 < 3.13.0, 3.13.15

rabbitmq-server >= 4.0.0, < 4.0.20 < 4.0.0, 4.0.20

rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11

References

https://github.com/rabbitmq/rabbitmq-server/security/advi...
x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/releases/tag/...
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.