CVE-2026-66074

Received Received - Intake

ReDoS Vulnerability in RabbitMQ Management Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name= regular expression to re:run with no match_limit option, and executes it once per resource in the result set. OTP's default 10M match_limit caps each call at roughly 100-200ms, but the regex runs once per resource in the result set. With a large set, for example 5000 queues at 150ms each, a single request consumes 12 or more minutes of CPU. Parallel requests saturate the schedulers. The use_regex=true option is a supported feature on list endpoints, so this path is reachable through normal API use. Preconditions include Any user with the management tag can exploit this.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-66074

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 3.13.15\|end_excluding=4.0.20\|end_excluding=4.1.11\|end_excluding=4.2.6\|end_excluding=4.3.0 (exc)
rabbitmq	rabbitmq	3.13.15
rabbitmq	rabbitmq	4.0.20
rabbitmq	rabbitmq	4.1.11
rabbitmq	rabbitmq	4.2.6
rabbitmq	rabbitmq	4.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

RabbitMQ is a messaging broker. This vulnerability involves the match_value/3 function in versions before 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. It allows users with the management tag to exploit a regex feature on list endpoints. The regex runs once per resource in the result set without a proper match limit, causing excessive CPU usage. For example, 5000 queues could consume 12+ minutes of CPU time per request.

Detection Guidance

This vulnerability can be detected by monitoring for unusually high CPU usage on RabbitMQ nodes, particularly during API requests that use regex patterns in query parameters. Check RabbitMQ management logs for requests with ?name= parameters and measure request processing times. High latency or CPU saturation during such requests may indicate exploitation.

Impact Analysis

This vulnerability can lead to denial-of-service (DoS) conditions. Attackers can saturate server CPU resources by sending crafted requests with regex patterns. This may cause system slowdowns, unresponsiveness, or crashes. Any user with management privileges can exploit it, making it a significant risk for RabbitMQ deployments.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 or later. Restrict access to the management interface to trusted users only. Monitor API requests for regex usage in ?name= parameters and block suspicious patterns at the network level.

Hi! I’m here to help you understand CVE-2026-66074. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70