CVE-2026-67418

Awaiting Analysis Awaiting Analysis - Queue

MQTT 5 Property Handling Flaw in RabbitMQ

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmq_mqtt/src/rabbit_mqtt_packet.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated publisher with topic write permission can cause the broker to store and route that inapplicable property to a separately authenticated matching subscriber. When the subscriber path serializes the outbound PUBLISH, serialise_prop/2 has no matching clause, and the uncontained function_clause exception closes the victim MQTT or Web MQTT connection. The publisher connection and broker remain available, and queued replay, retained-message persistence, and broker-wide denial of service were not established. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-67418

EUVD

EUVD-2026-101419

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq-server	>= 3.13.0, < 3.13.19
rabbitmq	rabbitmq-server	>= 4.0.0, < 4.0.24
rabbitmq	rabbitmq-server	>= 4.1.0, < 4.1.15
rabbitmq	rabbitmq-server	>= 4.2.0, < 4.2.10
rabbitmq	rabbitmq-server	>= 4.3.0, < 4.3.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.
CWE-1286	The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

Attack-Flow Graph

Executive Summary

CVE-2026-67418 is a vulnerability in RabbitMQ's MQTT 5.0 implementation where an authenticated publisher can include an invalid property, Request-Problem-Information, in a PUBLISH packet. This property is only valid for CONNECT packets. The broker accepts and stores it, but when a subscriber's reader tries to serialize the outbound PUBLISH, it fails due to a missing serializer clause, causing a function_clause error. This disconnects the victim's MQTT connection while leaving the publisher's connection and broker unaffected.

Detection Guidance

Detecting this vulnerability requires monitoring for MQTT 5 PUBLISH packets containing invalid properties like Request-Problem-Information. Check RabbitMQ logs for connection terminations with function_clause errors during PUBLISH serialization. Use tcpdump or Wireshark to inspect MQTT traffic for malformed packets with property 0x17 in PUBLISH frames.

Impact Analysis

The impact is limited to disconnecting the victim's MQTT or Web MQTT session. The attacker's connection and the broker remain operational. It requires an authenticated MQTT 5 client with write permissions and a separately authenticated subscriber to the same topic. No data loss or broker-wide denial of service occurs.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it only causes a denial of service for a single MQTT client connection without affecting data integrity or confidentiality. The issue is limited to session termination for the victim and does not involve unauthorized access or data exposure.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, or 4.3.5 or later. Disable MQTT 5 if not required. Monitor for malformed packets and terminate suspicious client connections. Apply strict input validation for MQTT properties at the network perimeter.

Hi! I’m here to help you understand CVE-2026-67418. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70