Non-ASCII Cookie Name Vulnerability in RabbitMQ Messaging Broker
CVE-2026-67234
2.3LOW
What is CVE-2026-67234?
RabbitMQ, a widely-used messaging and streaming broker, contains a vulnerability affecting specific versions where the get_auth_mechanism/1 function improperly utilizes term_to_binary/1 on the strict_auth_mechanism or preferred_auth_mechanism atom. This results in the creation of a non-ASCII cookie name that contravenes RFC 6265 standards. Although this issue does not directly enable code execution or data exfiltration, it poses a risk by allowing stale authentication-mechanism preferences to persist even after a user logs out and back in. Users are advised to upgrade to the patched versions 4.2.8 or 4.3.2 to mitigate this issue.
Affected Version(s)
rabbitmq-server >= 4.2.0, < 4.2.8 < 4.2.0, 4.2.8
rabbitmq-server >= 4.3.0, < 4.3.2 < 4.3.0, 4.3.2