Denial of Service in RabbitMQ Stream Management from Low-Privilege Users
CVE-2026-67408
What is CVE-2026-67408?
A vulnerability in RabbitMQ version range 4.1.0 to 4.3.3, along with specific versions 4.2.9 and 4.1.11, permits a low-privilege management user to exploit the Stream Management feature. The vulnerability arises when such a user sends a crafted request containing binding keys to the API without having the necessary permissions. This allows the user to allocate excessive memory resources, potentially leading to a denial of service on the RabbitMQ node, especially in environments with memory constraints. The issue has been addressed in subsequent releases, improving the robustness of the Stream Management capabilities.
Affected Version(s)
rabbitmq-server >= 4.3.0, < 4.3.3 < 4.3.0, 4.3.3
rabbitmq-server >= 4.2.0, < 4.2.9 < 4.2.0, 4.2.9
rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11