CVE-2026-67414

Awaiting Analysis Awaiting Analysis - Queue

Memory Exhaustion in RabbitMQ via AMQP 1.0 Arrays

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-67414

EUVD

EUVD-2026-101296

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq-server	>= 4.0.0, < 4.0.24
rabbitmq	rabbitmq-server	>= 4.1.0, < 4.1.15
rabbitmq	rabbitmq-server	>= 4.2.0, < 4.2.10
rabbitmq	rabbitmq-server	>= 4.3.0, < 4.3.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service issue in RabbitMQ's AMQP 1.0 parser. It allows memory exhaustion through amplification where a small frame sent by an attacker is expanded into multiple gigabytes of memory usage. The parser processes zero-width array aggregations without aggregate size limits, consuming excessive heap memory before validation or authorization checks.

Detection Guidance

Monitor RabbitMQ memory usage and logs for abnormal spikes or OOM events. Check for repeated AMQP 1.0 frames with zero-width arrays. Use Erlang VM tools like observer:start() to inspect heap usage. Inspect network traffic for large payloads from authenticated clients.

Impact Analysis

An attacker with low-privilege access can send a small frame that causes the RabbitMQ node to exhaust memory, triggering node-wide memory alarms, blocking publishers, or crashing the broker entirely. This leads to service disruption and potential downtime for systems relying on RabbitMQ.

Compliance Impact

This vulnerability primarily impacts availability by enabling memory exhaustion attacks, which could lead to service disruption or crashes. For GDPR, this may affect the integrity and availability of personal data processing systems. HIPAA requires safeguards for data availability, so prolonged outages could pose compliance risks. However, the CVE does not directly address data confidentiality or integrity breaches.

Mitigation Strategies

Upgrade RabbitMQ to patched versions (4.0.24, 4.1.15, 4.2.10, or 4.3.4). Disable AMQP 1.0 listener if not needed by setting listeners.amqp.default = none in config. Restrict vhost permissions for low-privilege users. Monitor memory alarms and block suspicious clients.

Hi! I’m here to help you understand CVE-2026-67414. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70