CVE-2026-66079 - Vulnerability Details

- RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Published: 2026-09-23

Score: 8.2 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in RabbitMQ's AMQP 1.0 parsing logic creates a zero‑width array element before authentication. The buggy parser accepts a 19‑byte frame that requests an array of 4 billion empty items, causing the Erlang VM to exhaust heap memory and terminate. The effect is a complete loss of all tenants and protocols on the affected node, as the broker stops responding entirely.

Affected Systems

RabbitMQ Server is affected in all releases earlier than 3.13.15, 4.0.20, 4.1.11, and 4.2.6. These versions expose the AMQP 1.0 listener on the default port 5672.

Risk and Exploitability

The vulnerability has a CVSS score of 8.2 and is not listed in the CISA KEV catalog. An unauthenticated network attacker gains access to the AMQP 1.0 listener on port 5672, which is enabled by default, and can send a single crafted frame to trigger the crash. Because no authentication or additional controls are required, the attack vector is straightforward over the public network, leading to high exploitation potential.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

rabbitmq

rabbitmq-server

affected

Version	Status	Constraints
`>= 3.13.0, < 3.13.15`	affected	—
`>= 4.0.0, < 4.0.20`	affected	—
`>= 4.1.0, < 4.1.11`	affected	—
`>= 4.2.0, < 4.2.6`	affected	—

No data.

Package	CPE	Advisory	Released Date
Red Hat Hardened Images
rabbitmq-server4-3-main-4.3.6-1.hum1	cpe:/a:redhat:hummingbird:1	RHSA-2026:67552	2026-09-15T00:00:00Z

Vendor Product Confidence Versions

Rabbitmq

Rabbitmq-server

95%

Version	Status	Scheme	Platform
`[3.13.0,3.13.15)`	affected	semver	—
`[4.0.0,4.0.20)`	affected	semver	—
`[4.1.0,4.1.11)`	affected	semver	—
`[4.2.0,4.2.6)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest RabbitMQ Server release (≥3.13.15, 4.0.20, 4.1.11 or 4.2.6) to remove the parsing bug.
If an upgrade cannot be performed immediately, restrict or disable the AMQP 1.0 listener on port 5672 using firewall rules or by disabling the feature in the configuration.
As an additional control, limit the incoming_max_frame_size or monitor for unusually large frames, but the most effective mitigation is to patch or block the vulnerable protocol.

Generated by OpenCVE AI on September 23, 2026 at 21:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0032.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9
https://nvd.nist.gov/vuln/detail/CVE-2026-66079
https://www.cve.org/CVERecord?id=CVE-2026-66079

History

Tue, 29 Sep 2026 03:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 25 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat hummingbird
CPEs		cpe:/a:redhat:hummingbird:1
Vendors & Products		Redhat Redhat hummingbird
References		https://nvd.nist.gov/vuln/detail/CVE-2026-66079 https://www.cve.org/CVERecord?id=CVE-2026-66079
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Important`

Wed, 23 Sep 2026 23:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Rabbitmq Rabbitmq rabbitmq-server
Vendors & Products		Rabbitmq Rabbitmq rabbitmq-server

Wed, 23 Sep 2026 20:15:00 +0000

Type	Values Removed	Values Added
Description		RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Title		RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS
Weaknesses		CWE-770
References		https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9
Metrics		cvssV4_0 `{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Rabbitmq Rabbitmq-server

Redhat Hummingbird

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-09-23T20:01:15.295Z

Updated: 2026-09-29T02:12:45.139Z

Reserved: 2026-07-23T23:25:28.898Z

Link: CVE-2026-66079

Vulnrichment

Updated: 2026-09-29T02:12:41.102Z

NVD

Status : Undergoing Analysis

Published: 2026-09-23T20:17:13.150

Modified: 2026-09-29T03:17:17.063

Link: CVE-2026-66079

Redhat

Severity : Important

Publid Date: 2026-09-23T20:01:15Z

Links: CVE-2026-66079 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-23T23:15:10Z

Weaknesses

CWE-770
Allocation of Resources Without Limits or Throttling

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object