RabbitMQ’s MQTT 5 packet parser accepts the Request‑Problem‑Information property on PUBLISH messages even though that property is only valid for CONNECT. When an authenticated publisher sends a PUBLISH packet with this inapplicable property, the broker’s outgoing serialization path throws an unhandled function_clause exception, which closes the matching subscriber’s MQTT or Web MQTT connection. The broker and publisher connection remain available, so the issue does not bring down the whole broker but it does interrupt the subscriber’s session and any inflight traffic. This effect can degrade real‑time messaging reliability for consumers of the affected topic.

The vulnerability affects RabbitMQ Server from version 3.13.0 up to and including 3.13.19, and versions 4.0.24, 4.1.15, 4.2.10, and 4.3.5. The problem resides in the deps/rabbitmq_mqtt/src/rabbit_mqtt_packet.erl module handling MQTT 5 packets.

The CVSS score of 5.3 indicates a moderate risk. No publicly known exploit is listed in CISA’s KEV catalog, and the EPSS score is 0.004, indicating a very low exploitation probability. The attack vector requires an authenticated publisher who has write permission to a topic that a subscriber consumes. By sending a crafted PUBLISH packet containing the invalid property, the attacker can cause the broker to close the subscriber’s connection. The exploit is local to the MQTT broker and does not lead to arbitrary code execution or system compromise.