Routing Key Vulnerability in RabbitMQ Messaging Broker
CVE-2026-67219
6MEDIUM
What is CVE-2026-67219?
The RabbitMQ messaging and streaming broker contains a vulnerability where add_binding/3 improperly handles routing keys as integer weights, lacking an upper limit validation. This allows users with specific permissions to create bindings with excessively large integer weights, impacting memory allocation across cluster nodes. A single malicious binding can cause substantial resource allocation, leading to potential denial of service. This issue is addressed in newer versions, where proper validation constraints are implemented.
Affected Version(s)
rabbitmq-server >= 3.13.0, < 3.13.15 < 3.13.0, 3.13.15
rabbitmq-server >= 4.0.0, < 4.0.20 < 4.0.0, 4.0.20
rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11