Memory Management Issue in RabbitMQ Messaging and Streaming Broker
CVE-2026-67414
6MEDIUM
What is CVE-2026-67414?
A memory management issue exists in RabbitMQ that affects versions from 4.0.0 to 4.0.24, as well as specific versions in the 4.1, 4.2, and 4.3 series. It arises when low-privilege clients authenticate and send frames containing AMQP 1.0 arrays with allowed element counts, which can expand excessively in the process heap. This behavior risks triggering a node-wide memory alarm, potentially blocking publishers and exhausting the broker's memory resources. The problem has been addressed in the fixed releases of RabbitMQ.
Affected Version(s)
rabbitmq-server >= 4.0.0, < 4.0.24 < 4.0.0, 4.0.24
rabbitmq-server >= 4.1.0, < 4.1.15 < 4.1.0, 4.1.15
rabbitmq-server >= 4.2.0, < 4.2.10 < 4.2.0, 4.2.10