Denial of Service Vulnerability in RabbitMQ Messaging Broker
CVE-2026-67413
What is CVE-2026-67413?
The RabbitMQ messaging broker, from versions 4.0.0 to 4.0.23, along with 4.1.14, 4.2.9, and 4.3.3, contains a vulnerability in the optional rabbitmq_jms_topic_exchange plugin. It allows an authenticated user to exploit the x-jms-topic exchange by using a client-controlled rjms_erlang_selector binding expression. This malicious expression could cause overlapping PCRE fragments to be created and executed without any match or recursion limits. As a result, the broker's scheduler CPU resources can be consumed extensively, leading to a denial of service. This issue has been addressed in the latest releases.
Affected Version(s)
rabbitmq-server >= 4.2.0, < 4.2.9 < 4.2.0, 4.2.9
rabbitmq-server >= 4.1.0, < 4.1.14 < 4.1.0, 4.1.14
rabbitmq-server >= 4.3.0, < 4.3.3 < 4.3.0, 4.3.3