WebSocket Vulnerability in RabbitMQ Messaging Broker
CVE-2026-67230
6.3MEDIUM
What is CVE-2026-67230?
The RabbitMQ messaging broker features a vulnerability in its Web STOMP WebSocket handler where it fails to enforce max_frame_size and login_timeout settings before authentication. This flaw allows unauthenticated clients to maintain connections by sending a slow stream of small frames, potentially leading to an accumulation of unbounded pre-authentication state. To exploit this vulnerability, the rabbitmq_web_stomp plugin must be activated, and no authentication is necessary to access the impacted route. This issue has been addressed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Affected Version(s)
rabbitmq-server >= 4.2.0, < 4.2.6 < 4.2.0, 4.2.6
rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11
rabbitmq-server >= 4.0.0, < 4.0.20 < 4.0.0, 4.0.20