Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Published: 2026-09-23
Score: 8.2 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

A flaw in RabbitMQ's AMQP 1.0 parsing logic creates a zero‑width array element before authentication. The buggy parser accepts a 19‑byte frame that requests an array of 4 billion empty items, causing the Erlang VM to exhaust heap memory and terminate. The effect is a complete loss of all tenants and protocols on the affected node, as the broker stops responding entirely.

Affected Systems

RabbitMQ Server is affected in all releases earlier than 3.13.15, 4.0.20, 4.1.11, and 4.2.6. These versions expose the AMQP 1.0 listener on the default port 5672.

Risk and Exploitability

The vulnerability has a CVSS score of 8.2 and is not listed in the CISA KEV catalog. An unauthenticated network attacker gains access to the AMQP 1.0 listener on port 5672, which is enabled by default, and can send a single crafted frame to trigger the crash. Because no authentication or additional controls are required, the attack vector is straightforward over the public network, leading to high exploitation potential.

Generated by OpenCVE AI on September 23, 2026 at 21:27 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest RabbitMQ Server release (≥3.13.15, 4.0.20, 4.1.11 or 4.2.6) to remove the parsing bug.
  • If an upgrade cannot be performed immediately, restrict or disable the AMQP 1.0 listener on port 5672 using firewall rules or by disabling the feature in the configuration.
  • As an additional control, limit the incoming_max_frame_size or monitor for unusually large frames, but the most effective mitigation is to patch or block the vulnerable protocol.

Generated by OpenCVE AI on September 23, 2026 at 21:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Title RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS
Weaknesses CWE-770
References
Metrics cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-23T20:01:15.295Z

Reserved: 2026-07-23T23:25:28.898Z

Link: CVE-2026-66079

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-23T20:17:13.150

Modified: 2026-09-23T20:17:13.150

Link: CVE-2026-66079

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T21:30:07Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling