Description
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max_frame_size nor login_timeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frames and accumulate unbounded pre-authentication state. The rabbitmq_web_stomp plugin must be enabled, and no authentication is required to reach the vulnerable path. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Published: 2026-09-25
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Resource Exhaustion / Denial of Service
Action: Apply Patch
AI Analysis

Impact

This vulnerability allows an unauthenticated client to keep an HTTP WebSocket connection open by sending a very slow stream of tiny frames before authentication. The RabbitMQ Web STOMP handler does not enforce limits such as frame size or login timeout until authentication occurs, letting the server accumulate an unbounded amount of state for each connection. The resulting memory and resource consumption can lead to degraded server performance or a DoS condition for all clients.

Affected Systems

The affected product is RabbitMQ Server, specifically when the rabbitmq_web_stomp plugin is enabled. Versions 3.13.0 through 3.13.15, 4.0.20, 4.1.11, and 4.2.6 are vulnerable; these releases have been updated in the corresponding patched versions.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. Although no EPSS score is provided, the vulnerability can be exploited remotely through an unauthenticated WebSocket connection, making it potentially accessible to anyone able to reach the RabbitMQ port. This escalation does not require privileges or authentication, making it attractive for attackers. The vulnerability is not currently listed in the CISA KEV catalog.

Generated by OpenCVE AI on September 25, 2026 at 19:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade RabbitMQ to version 3.13.15, 4.0.20, 4.1.11, or 4.2.6 (or later) to apply the vendor patch.
  • If an upgrade is not possible immediately, disable the rabbitmq_web_stomp plugin to prevent unauthenticated access to the vulnerable WebSocket path.
  • Configure network firewall rules or RabbitMQ ACLs to restrict inbound access to the WebSocket endpoint only to trusted hosts, limiting exposure of the vulnerable path.

Generated by OpenCVE AI on September 25, 2026 at 19:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Rabbitmq
Rabbitmq rabbitmq-server
Vendors & Products Rabbitmq
Rabbitmq rabbitmq-server

Fri, 25 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max_frame_size nor login_timeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frames and accumulate unbounded pre-authentication state. The rabbitmq_web_stomp plugin must be enabled, and no authentication is required to reach the vulnerable path. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Title RabbitMQ: Web-STOMP unbounded pre-auth accumulation
Weaknesses CWE-770
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Rabbitmq Rabbitmq-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-29T19:22:26.179Z

Reserved: 2026-07-28T19:50:39.437Z

Link: CVE-2026-67230

cve-icon Vulnrichment

Updated: 2026-09-29T19:22:21.479Z

cve-icon NVD

Status : Undergoing Analysis

Published: 2026-09-25T17:17:11.600

Modified: 2026-09-29T20:17:22.350

Link: CVE-2026-67230

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T11:30:09Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling