CVE-2026-66072

Received Received - Intake

Denial of Service in RabbitMQ Stream Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-66072

EUVD

EUVD-2026-85634

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 3.13.15\|end_excluding=4.0.20\|end_excluding=4.1.11\|end_excluding=4.2.6\|end_excluding=4.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

RabbitMQ versions before 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1 have a flaw in the rabbitmq_stream plugin. The get_chunk_selector/1 function processes a client-supplied chunk_selector property without validation, converting it directly to an atom. An authenticated user with read access to any stream can exploit this to crash the broker node.

Impact Analysis

If you use RabbitMQ with the stream plugin enabled, an attacker with valid credentials and read access to a stream could crash the broker node, causing service disruption. This requires pre-authenticated access but no additional privileges beyond read permissions.

Mitigation Strategies

Upgrade RabbitMQ to a patched version (3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1 or later) to address the binary_to_atom vulnerability in the rabbitmq_stream plugin.

Hi! I’m here to help you understand CVE-2026-66072. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70