The RabbitMQ management HTTP API incorrectly validates the size of JSON request bodies in the with_decode and direct_request paths; the API checks the size. An oversized payload that exceeds the configured max_http_body_size is therefore accepted, causing the broker to allocate excessive memory and potentially crash or become unresponsive. This results in a classic resource exhaustion flaw (CWE‑770) that can bring the entire RabbitMQ instance down for malicious actors.

RabbitMQ Server is vulnerable in all releases prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5. The flaw specifically affects the with_decode and direct_request paths of the management HTTP API, which are available to any client that connects to the management interface.

The CVSS score of 7.1 classifies the vulnerability as high severity. The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely abused. The likely attack vector is through the vulnerable management API endpoints; it is inferred that an attacker would need the ability to send authenticated requests to those paths in order to trigger the oversized‑body acceptance. Once the broker processes the large body, memory exhaustion may occur, leading to service disruption.