An authenticated user who can bind a queue to a topic exchange and publish to it can take advantage of consecutive # wildcard segments in a binding key. The RabbitMQ router processes these segments by revisiting the same trie-node and routing-key-suffix states repeatedly, without memoization. As a result, the matcher creates duplicate destination entries before deduplication, leading to combinatorial CPU consumption and memory pressure. This can disrupt routing for all tenants, effectively causing a denial of service.

The issue exists in RabbitMQ Server versions before 4.3.5. Any deployment running an earlier version is vulnerable if users have permissions to bind queues to topic exchanges and publish messages. Updating to 4.3.5 or later eliminates the flaw.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog. Exploitation requires an authenticated user with binding and publishing rights, which is likely achievable only by individuals with sufficient privilege within the RabbitMQ environment. While there is no known widespread exploitation, the potential generation of excessive CPU and memory load can cause system instability and loss of message routing across all tenants. Managers should consider the likelihood of privileged access when assessing risk.