Description
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq_jms_topic_exchange plugin's x-jms-topic exchange accepted a client-controlled rjms_erlang_selector binding expression whose LIKE evaluator expanded percent and underscore wildcards into overlapping PCRE fragments. It executed those fragments with raw re:run/3 without match or recursion limits, allowing an authenticated tenant that can bind and publish to consume broker scheduler CPU and deny service with pathological selectors. This issue is fixed in versions 4.0.23, 4.1.14, 4.2.9, and 4.3.3.
Published: 2026-09-25
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A flaw in the optional rabbitmq_jms_topic_exchange plugin allows an authenticated user to bind a topic selector that contains an unbounded LIKE regular expression. The selector’s wildcard characters are poorly escaped, enabling the server to execute a large number of overlapping PCRE fragments without any limit on token consumption. When the broker processes such a selector it can consume excessive CPU resources, leading to a denial of service for the entire broker.

Affected Systems

The vulnerability affects RabbitMQ Server from version 4.0.0 through 4.0.23, 4.1.14, 4.2.9, and 4.3.3. The affected component is the rabbitmq_jms_topic_exchange plugin. Versions 4.0.23, 4.1.14, 4.2.9, and 4.3.3 contain the fix; installations of these versions are not impacted.

Risk and Exploitability

The CVSS v3 score of 6 indicates moderate risk. No current EPSS data is available, but the vulnerability requires authentication to an enabled plugin, making it a local or application‑level attack. The attack can be executed by a legitimate tenant with publishing rights and will consume broker CPU, potentially denying service to other users. The issue is not listed in CISA KEV and there are no known public exploits at this time.

Generated by OpenCVE AI on September 25, 2026 at 18:31 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade RabbitMQ to version 4.0.23, 4.1.14, 4.2.9, or 4.3.3 or later, which contains the fix for the unbounded regex issue.
  • If the rabbitmq_jms_topic_exchange plugin is not required, disable it to eliminate the attack surface.
  • After upgrade or disabling the plugin, test that the selector parsing is no longer permissive by attempting to bind a selector with percent or underscore wildcards and verifying normal CPU usage.

Generated by OpenCVE AI on September 25, 2026 at 18:31 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Broadcom
Broadcom rabbitmq Server
CPEs cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
Vendors & Products Broadcom
Broadcom rabbitmq Server
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Tue, 29 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Rabbitmq
Rabbitmq rabbitmq-server
Vendors & Products Rabbitmq
Rabbitmq rabbitmq-server

Fri, 25 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmq_jms_topic_exchange plugin's x-jms-topic exchange accepted a client-controlled rjms_erlang_selector binding expression whose LIKE evaluator expanded percent and underscore wildcards into overlapping PCRE fragments. It executed those fragments with raw re:run/3 without match or recursion limits, allowing an authenticated tenant that can bind and publish to consume broker scheduler CPU and deny service with pathological selectors. This issue is fixed in versions 4.0.23, 4.1.14, 4.2.9, and 4.3.3.
Title RabbitMQ: Authenticated RabbitMQ JMS Topic Selector Users Can Consume Broker CPU with an Unbounded LIKE Regular Expression
Weaknesses CWE-1333
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Broadcom Rabbitmq Server
Rabbitmq Rabbitmq-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-29T19:30:15.380Z

Reserved: 2026-07-29T15:02:20.412Z

Link: CVE-2026-67413

cve-icon Vulnrichment

Updated: 2026-09-29T19:30:09.071Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-25T17:17:13.547

Modified: 2026-10-16T16:02:56.927

Link: CVE-2026-67413

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T11:30:09Z

Weaknesses
  • CWE-1333

    Inefficient Regular Expression Complexity