CVE-2026-67416

Awaiting Analysis Awaiting Analysis - Queue

AMQP 1.0 Descriptor Parsing Flaw in RabbitMQ

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, the optimized AMQP 1.0 server_mode parser in deps/amqp10_common/src/amqp10_binary_parser.erl matches the textual prefixes of symbolic data, sequence, and value body descriptors without verifying their encoded symbol lengths. An authenticated AMQP 1.0 publisher with write permission can submit a well-formed unknown descriptor that begins with a registered body descriptor, and RabbitMQ misclassifies and stores the bytes as a standard body section. Strict AMQP 1.0 consumers can terminate while decoding the stored entry. For bodies misclassified as data, AMQP 0-9-1 or other cross-protocol conversion performs full body decoding and can terminate the consumer protocol process, with acknowledgement-required delivery permitting repeated failures. Sequence and value classifications are normally transported as opaque encoded payloads on that conversion path. The broker remains alive, and the issue does not bypass routing or authorization. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-67416

EUVD

EUVD-2026-101294

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq-server	>= 4.0.0, < 4.0.24
rabbitmq	rabbitmq-server	>= 4.1.0, < 4.1.15
rabbitmq	rabbitmq-server	>= 4.2.0, < 4.2.10
rabbitmq	rabbitmq-server	>= 4.3.0, < 4.3.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-754	The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability affects RabbitMQ's AMQP 1.0 message parser. It incorrectly classifies symbolic message body descriptors based on textual prefixes alone, without verifying the encoded symbol lengths. An attacker with write permissions can submit a malformed descriptor starting with a valid prefix (e.g., 'amqp:data:binary') but with incorrect length, causing RabbitMQ to misclassify and store the message incorrectly. This can lead to consumer termination during message processing.

Detection Guidance

Detecting this vulnerability requires checking RabbitMQ server versions and monitoring for malformed AMQP 1.0 messages. Verify if your RabbitMQ version is below 4.0.24, 4.1.15, 4.2.10, or 4.3.4. Inspect AMQP 1.0 message logs for descriptors starting with standard prefixes like 'amqp:data:binary' but with incorrect lengths.

Impact Analysis

The vulnerability can disrupt service availability by causing consumer sessions or channels to terminate when processing malformed messages. This is particularly problematic during cross-protocol conversion (e.g., AMQP 1.0 to AMQP 0-9-1), where repeated failures may occur. The broker itself remains operational, but message processing is affected.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially disrupting data integrity and availability. Misclassified AMQP 1.0 messages may cause consumer process termination, leading to service disruptions that could affect data processing workflows. GDPR requires ensuring data integrity and availability, while HIPAA mandates reliable data transmission. The vulnerability does not bypass authorization but may cause repeated failures in consumer processes during cross-protocol conversion, which could interfere with logging and monitoring requirements.

Mitigation Strategies

Upgrade RabbitMQ to version 4.0.24, 4.1.15, 4.2.10, or 4.3.4 or later to patch the AMQP 1.0 parser issue.
Restrict AMQP 1.0 write permissions to trusted users to limit potential exploitation.
Monitor message queues for malformed AMQP 1.0 messages that may trigger consumer terminations.

Hi! I’m here to help you understand CVE-2026-67416. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70