A compressed WebSocket frame can trigger a decompression bomb in the RabbitMQ Web-MQTT plugin, causing the node to allocate gigabytes of memory and crash. The vulnerability arises because the underlying WebSocket handler inflates frames without imposing an output‑size limit, so a tiny packet on the wire can expand to massive memory usage before any MQTT packet is processed. This results in a service disruption but does not expose data or allow arbitrary code execution.

Unofficial RabbitMQ Server installations running any of the following pre‑patch versions are affected: 3.13.14 and earlier, 4.0.19 and earlier, 4.1.10 and earlier, 4.2.5 and earlier, and 4.2.5‑prior to 4.3.0. The bug is present only when the rabbitmq_web_mqtt plugin is enabled and the broker listens on the default Web‑MQTT ports (15675 for WebSocket over TLS or 15676 for clear text). Any environment permitting unauthenticated network traffic to these ports is at risk.

The CVSS score of 8.2 indicates a high severity of this denial‑of‑service flaw. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. An attacker can reach the vulnerable endpoint from any network that can connect to port 15675 or 15676, negotiate the permessage-deflate extension, and send a single maliciously compressed frame that inflates to gigabytes of memory. No credentials are required, so any host with outbound connectivity to the broker can trigger the crash. Once the node is exhausted, normal broker operations cease until it is restarted, leading to significant downtime for dependent applications.