Message Broker Vulnerability in RabbitMQ Products
CVE-2026-66080
5.9MEDIUM
What is CVE-2026-66080?
The vulnerability in RabbitMQ arises from inadequate input validation in the validate_partitions function, which only ensures that the partition count is at least 1 without imposing an upper limit. This flaw can lead to excessive memory allocation, with requests for large partition counts (e.g., lists:seq(0, 500000000)) potentially consuming around 8GB of memory. The issue specifically affects users with the rabbitmq_stream_management plugin enabled, who possess the management tag and access to the corresponding virtual host. The flaw has been remedied in versions 4.1.11, 4.2.6, and 4.3.0.
Affected Version(s)
rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11
rabbitmq-server >= 4.2.0, < 4.2.6 < 4.2.0, 4.2.6