RabbitMQ is a messaging broker. The vulnerability described as a regular expression denial of service arises when match_value/3 receives a user supplied ?name= regular expression. The OTP re:run engine executes this regex without a limit on the match size, and the call is repeated for each resource in the result set. In large installations with thousands of queues, each match can take 100–200 ms, so a single API request can consume tens of minutes of CPU, leading to service disruption.

RabbitMQ Server versions earlier than 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 are affected. The corresponding patched releases contain the fix that limits the regex processing or removes the unbounded match.

The CVSS score of 6 indicates moderate severity. Attackers only need any user with the management tag, which is common within internal accounts, and can trigger the exploit through a normal API call to a list endpoint with use_regex=true. Because the EPSS is not available and the vulnerability is not listed in KEV, the explicit exploit probability is unclear, but the realistic attack path and resource exhaustion likely pose a notable risk to availability in environments where the management API is exposed.