The vulnerability allows an attacker to declare an extremely large message size, causing RabbitMQ to accumulate fragments without validating the total body size. This results in unchecked memory growth in the reader process, which can trigger a memory alarm that throttles all publishers or, if the node exhausts memory, may crash the node. The weakness is a Resource Exhaustion flaw identified as CWE‑770. The impact is a denial‑of‑service that affects the entire broker cluster but does not provide code‑execution or information‑exfiltration capabilities.

RabbitMQ Server versions prior to 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15 are affected. The weakness exists in the AMQP 0‑9‑1 protocol handling of message body assembly. To avoid exploitation, upgrade to any of the fixed releases listed above.

The severity is high with a CVSS score of 7.1. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires any authenticated AMQP 0‑9‑1 client that has publish permission; the attacker sends a message with a declared body size of 2^63‑1 and streams fragments to bypass the size check. Because the memory alarm is reactive, a successful attack can degrade or deny service before the alarm intervenes. The exploit is straightforward once the client has a publishing role, and its success depends on the broker’s available memory and configured limits.