Description
RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11.
Published: 2026-09-25
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

This vulnerability allows a low-privileged authenticated management user to cause a denial of service by sending a maliciously crafted HTTP PUT request to the /api/stream/super-streams endpoint. The request body can contain a large binding-keys string; the server parses it and temporarily allocates memory before performing any permission checks, potentially exhausting available memory and forcing the RabbitMQ node to crash. The weakness is a resource exhaustion flaw (CWE-400, CWE-408).

Affected Systems

RabbitMQ Server from versions 4.1.0 to 4.3.3, including the specific patch candidates 4.2.9 and 4.1.11, is affected. The issue is resolved in releases 4.3.3, 4.2.9, and 4.1.11. The vulnerability is triggered when rabbitmqstreammanagement is enabled.

Risk and Exploitability

The CVSS v3.1 score of 7.1 indicates a high impact, while the EPSS score of < 1% suggests a very low but non-zero likelihood of exploitation. Attackers need only an authenticated low-privileged management user with access to the target vhost; by exploiting the endpoint with a single large payload they can force a container or node to exit. The likely attack vector is a TCP connection to the management API over HTTP or HTTPS, making it feasible for remote actors if the API is exposed.

Generated by OpenCVE AI on October 3, 2026 at 01:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade RabbitMQ Server to a fixed release such as 4.3.3, 4.2.9, or 4.1.11.
  • If the stream management feature is not required, disable the rabbitmqstreammanagement plugin.
  • Restrict low-privileged management users from accessing super-stream APIs or constrain their permissions so they cannot configure streams.

Generated by OpenCVE AI on October 3, 2026 at 01:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 08 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Broadcom
Broadcom rabbitmq Server
CPEs cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
Vendors & Products Broadcom
Broadcom rabbitmq Server

Sat, 03 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-408
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sat, 26 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Rabbitmq
Rabbitmq rabbitmq-server
Vendors & Products Rabbitmq
Rabbitmq rabbitmq-server

Fri, 25 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11.
Title RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service
Weaknesses CWE-400
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Broadcom Rabbitmq Server
Rabbitmq Rabbitmq-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-25T19:09:53.750Z

Reserved: 2026-07-29T15:02:20.411Z

Link: CVE-2026-67408

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-09-25T17:17:12.767

Modified: 2026-10-08T15:33:05.360

Link: CVE-2026-67408

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-25T16:35:22Z

Links: CVE-2026-67408 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-03T02:00:22Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-408

    Incorrect Behavior Order: Early Amplification