Description
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, pattern_to_regex maps % -> .*? and _ -> ., then compiles ^...$ with only [unicode]; re:run is called with only [{capture, none}] - no explicit match_limit. A pattern like %_%_..._%X becomes ^.*?..*?.....*?.X$ with overlapping lazy quantifiers. The whole-expression cap is ?MAX_EXPRESSION_LENGTH=4096 chars / ?MAX_TOKENS=200; a LIKE string literal is one token, so ~2000 %_ pairs fit. SQL filters are accepted unconditionally at rabbit_amqp_session.erl:3264 (no feature flag). Evaluated per-message at rabbit_stream_queue.erl:1439. OTP's default 10M match_limit caps each match at ~100-200 ms (not seconds), and the re NIF yields to the scheduler. An authenticated AMQP 1.0 consumer with read+write on a stream queue can cause ~100-200 ms of CPU per delivered message via a crafted LIKE filter, multiplied across thousands of messages and parallel sessions - a substantial backtracking-driven CPU amplification. Preconditions include AMQP 1.0 with stream queues in use Attacker can attach a receiver with a filter (read permission) and publish messages with long property values (write permission). This issue is fixed in versions 4.2.7 and 4.3.1.
Published: 2026-09-23
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via CPU exhaustion
Action: Assess Impact
AI Analysis

Impact

RabbitMQ is vulnerable to a regular expression back‑tracking attack when processing AMQP 1.0 SQL filter LIKE wildcards. The system converts pattern strings such as % to .*? and _ to ., then compiles a regex that can contain hundreds of overlapping lazy quantifiers. A carefully crafted filter like %_%_…_%X triggers exponential back‑tracking, causing the Erlang VM to spend 100–200 ms of CPU per message. When many messages are processed in parallel, the CPU load scales rapidly, potentially exhausting server resources and interrupting normal operation.

Affected Systems

The flaw affects RabbitMQ server versions older than 4.2.7 and 4.3.1. Users running any pre‑4.2.7 release or pre‑4.3.1 release with AMQP 1.0 stream queues enabled are susceptible. No specific product line is excluded; all RabbitMQ server instances that accept AMQP 1.0 connections can be impacted.

Risk and Exploitability

The CVSS score is 2.3, indicating low severity, and no EPSS data or KEV listing is available. Exploitation requires an authenticated AMQP 1.0 consumer with read and write permissions on a stream queue, as the attacker must be able to attach a receiver that supplies the filter and publish messages with long property values. Once the conditions are met, each message can drain CPU resources, leading to a denial‑of‑service scenario. Because the vulnerability is triggered only when message traffic is high, the risk is moderate for exposed servers that handle many concurrent sessions.

Generated by OpenCVE AI on September 23, 2026 at 21:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade RabbitMQ server to version 4.2.7 or later, including 4.3.1, to remove the back‑tracking defect.
  • If an immediate upgrade is not possible, restrict or disable AMQP 1.0 stream queues for users that have both read and write capabilities, or deprecate the use of SQL filter LIKE wildcards in message routing.
  • Apply network or firewall rules to limit the number of concurrent AMQP connections and monitor CPU usage to detect abnormal spikes that might indicate exploitation.

Generated by OpenCVE AI on September 23, 2026 at 21:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 23 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Rabbitmq
Rabbitmq rabbitmq-server
Vendors & Products Rabbitmq
Rabbitmq rabbitmq-server

Wed, 23 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, pattern_to_regex maps % -> .*? and _ -> ., then compiles ^...$ with only [unicode]; re:run is called with only [{capture, none}] - no explicit match_limit. A pattern like %_%_..._%X becomes ^.*?..*?.....*?.X$ with overlapping lazy quantifiers. The whole-expression cap is ?MAX_EXPRESSION_LENGTH=4096 chars / ?MAX_TOKENS=200; a LIKE string literal is one token, so ~2000 %_ pairs fit. SQL filters are accepted unconditionally at rabbit_amqp_session.erl:3264 (no feature flag). Evaluated per-message at rabbit_stream_queue.erl:1439. OTP's default 10M match_limit caps each match at ~100-200 ms (not seconds), and the re NIF yields to the scheduler. An authenticated AMQP 1.0 consumer with read+write on a stream queue can cause ~100-200 ms of CPU per delivered message via a crafted LIKE filter, multiplied across thousands of messages and parallel sessions - a substantial backtracking-driven CPU amplification. Preconditions include AMQP 1.0 with stream queues in use Attacker can attach a receiver with a filter (read permission) and publish messages with long property values (write permission). This issue is fixed in versions 4.2.7 and 4.3.1.
Title RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard
Weaknesses CWE-1333
References
Metrics cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Rabbitmq Rabbitmq-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-24T14:24:51.504Z

Reserved: 2026-07-28T19:50:39.438Z

Link: CVE-2026-67240

cve-icon Vulnrichment

Updated: 2026-09-24T14:24:35.910Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T21:17:01.370

Modified: 2026-09-24T15:17:29.910

Link: CVE-2026-67240

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-23T20:19:22Z

Links: CVE-2026-67240 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T23:15:10Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity