RabbitMQ hosts a super‑stream partitions feature that, before the fix, validates only that the requested count is at least one, allowing an attacker to request an unbounded number of partitions such as a sequence from 0 to 500,000,000. This request forces the broker to allocate roughly 8 GB of memory, exhausting system resources and leading to broker instability or crashes, effectively causing a denial of service. The vulnerability is an example of CWE‑770 Resource Exhaustion.

RabbitMQ Server versions older than 4.1.11, 4.2.6, and 4.3.0 are affected. The rabbitmq_stream_management plugin must be enabled, and the attacker must possess the management tag and access to the target vhost. Updates to the specified releases correct the validation logic to enforce an upper bound on partition requests.

With a CVSS score of 5.9 the risk is medium, but the EPSS score is not available, so current exploitation probability data is missing. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed widespread exploitation yet. An attacker with management permissions can issue a large partition request via the stream management plugin, potentially exhausting memory and disrupting the broker. The risk is mitigated by updating the software or restricting the use of super‑streams.