AMQP 1.0 Server Vulnerability in RabbitMQ by Pivotal
CVE-2026-67416
5.3MEDIUM
What is CVE-2026-67416?
An improper input validation issue in RabbitMQ's AMQP 1.0 server_mode parser allows authenticated publishers to submit specially crafted descriptors that can be misclassified by the broker. This flaw could lead to severe disruptions in the consumer protocol process, particularly affecting strict AMQP 1.0 consumers during decoding. Although this results in inappropriate processing of the message, the broker's routing and authorization mechanisms remain intact. Users are advised to update to the patched versions to mitigate potential disruptions.
Affected Version(s)
rabbitmq-server >= 4.0.0, < 4.0.24 < 4.0.0, 4.0.24
rabbitmq-server >= 4.1.0, < 4.1.15 < 4.1.0, 4.1.15
rabbitmq-server >= 4.2.0, < 4.2.10 < 4.2.0, 4.2.10