Description
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.
Published: 2026-10-14
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via memory exhaustion
Action: Immediate Patch
AI Analysis

Impact

RabbitMQ's AMQP 1.0 parser expands arrays of zero width without limiting their total size, allowing a crafted frame after SASL authentication to consume excessive heap memory. The resulting memory alarm can block publishers or deplete broker resources, causing a denial of service. The flaw maps to uncontrolled resource consumption and memory allocation weaknesses.

Affected Systems

The vulnerability affects rabbitmq rabbitmq‑server versions 4.0.0‑4.0.24, 4.1.15, 4.2.10, and 4.3.4. Updating to any of these fixed releases or newer resolves the issue.

Risk and Exploitability

With a CVSS score of 6, the vulnerability is moderately severe. The EPSS score of < 1% indicates a very low likelihood of exploitation, and no exploit data are publicly available; it is also not listed in the CISA KEV catalog. An attacker must be able to authenticate to the broker with a low‑privilege client and then send an oversized frame, a scenario achievable over the network by anyone who can reach the AMQP port. The risk is that repeated or concurrent frames can trigger a node‑wide memory alarm and halt broker operations.

Generated by OpenCVE AI on October 15, 2026 at 18:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update RabbitMQ to version 4.0.24, 4.1.15, 4.2.10, 4.3.4, or newer, which include the AMQP 1.0 parser fix.
  • If immediate patching is not possible, disable or restrict AMQP 1.0 support to prevent the vulnerable parser from processing incoming frames.
  • After applying the patch or workaround, restart the broker to clear any pre‑auth memory allocation and monitor memory usage to ensure the issue is fully resolved.

Generated by OpenCVE AI on October 15, 2026 at 18:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 17 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Rabbitmq
Rabbitmq rabbitmq-server
Vendors & Products Rabbitmq
Rabbitmq rabbitmq-server

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 14 Oct 2026 16:15:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.
Title RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation
Weaknesses CWE-400
CWE-770
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Rabbitmq Rabbitmq-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-29T14:19:15.193Z

Reserved: 2026-07-29T15:02:20.412Z

Link: CVE-2026-67414

cve-icon Vulnrichment

Updated: 2026-10-29T14:18:51.488Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T16:17:50.703

Modified: 2026-10-29T15:17:23.947

Link: CVE-2026-67414

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-14T16:04:07Z

Links: CVE-2026-67414 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T19:30:06Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling