CVE-2026-66080

Received Received - Intake

Memory Exhaustion via Unbounded Partition Count in RabbitMQ

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validate_partitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq(0, 500000000) allocates roughly 8GB. Preconditions include The rabbitmq_stream_management plugin must be enabled. The caller needs the management tag and access to the target vhost.. This issue is fixed in versions 4.1.11, 4.2.6, and 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-66080

EUVD

EUVD-2026-85637

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.1.11 (exc)
rabbitmq	rabbitmq	to 4.2.6 (exc)
rabbitmq	rabbitmq	to 4.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

RabbitMQ is a messaging and streaming broker. This vulnerability allows an attacker to request an extremely high number of partitions (up to 500 million) via the validate_partitions function, which only checks for a minimum of 1 partition. This can lead to excessive memory allocation of roughly 8GB, causing denial of service.

Impact Analysis

This vulnerability can cause system crashes or severe performance degradation due to high memory consumption. It requires the rabbitmq_stream_management plugin to be enabled and the attacker to have management access to the target vhost.

Mitigation Strategies

Upgrade RabbitMQ to versions 4.1.11, 4.2.6, or 4.3.0 or later to address the issue. Disable the rabbitmq_stream_management plugin if not required. Restrict access to the management tag and target vhost to authorized users only.

Hi! I’m here to help you understand CVE-2026-66080. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70