CVE-2026-66072

Undergoing Analysis Undergoing Analysis - In Progress

Denial of Service in RabbitMQ Stream Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-12

NVD

CVE-2026-66072

EUVD

EUVD-2026-85634

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 3.13.15\|end_excluding=4.0.20\|end_excluding=4.1.11\|end_excluding=4.2.6\|end_excluding=4.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

RabbitMQ versions before 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1 have a flaw in the rabbitmq_stream plugin. The get_chunk_selector/1 function processes a client-supplied chunk_selector property without validation, converting it directly to an atom. An authenticated user with read access to any stream can exploit this to crash the broker node.

Detection Guidance

This vulnerability can be detected by checking if your RabbitMQ version is affected. Run: rabbitmq-diagnostics status | grep "RabbitMQ version". If the version is below 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1, the system is vulnerable. Additionally, verify if the rabbitmq_stream plugin is enabled with: rabbitmq-plugins list | grep stream.

Impact Analysis

If you use RabbitMQ with the stream plugin enabled, an attacker with valid credentials and read access to a stream could crash the broker node, causing service disruption. This requires pre-authenticated access but no additional privileges beyond read permissions.

Compliance Impact

This vulnerability allows an authenticated attacker to crash RabbitMQ nodes by exploiting improper handling of client-supplied input. While not directly tied to data exposure, such disruptions could impact availability of critical systems, potentially violating compliance requirements for uptime and reliability in standards like GDPR (data processing integrity) and HIPAA (system availability for healthcare data).

Mitigation Strategies

Upgrade RabbitMQ to a patched version (3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1 or later) to address the binary_to_atom vulnerability in the rabbitmq_stream plugin.

Hi! I’m here to help you understand CVE-2026-66072. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70