CVE-2026-67220

Received Received - Intake

Memory Exhaustion via JMS Selector in RabbitMQ

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, When a binding is created on an x-jms-topic exchange, add_binding/3 reads the rjms_erlang_selector argument and passes it through erl_scan:string/1 then erl_parse:parse_term/1. erl_scan:string/1 interns every atom literal it tokenizes. validate_binding/2 is a no-op (-> ok.), there is no length cap, and the surrounding try/catch cannot reclaim atoms. The Java JMS client compiles selectors client-side, but the server does not enforce this , a raw AMQP client can send arbitrary selector strings. An authenticated low-privilege AMQP user confined to one vhost can crash the entire broker node (cross-tenant DoS) in <100 bind calls. Preconditions include rabbitmq_jms_topic_exchange plugin enabled (bundled; required for any JMS deployment) Authenticated AMQP user with read on an x-jms-topic exchange + write on a queue (or configure to declare both). This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-67220

EUVD

EUVD-2026-85630

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 3.13.15\|end_excluding=4.0.20\|end_excluding=4.1.11\|end_excluding=4.2.6\|end_excluding=4.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ allows an authenticated low-privilege user to crash the entire broker node by sending malicious selector strings to an x-jms-topic exchange. The issue occurs because the server does not validate the length or content of these selectors, leading to excessive atom interning and memory exhaustion.

Impact Analysis

An attacker could exploit this to cause a denial-of-service (DoS) on the RabbitMQ broker, disrupting all messaging services. This requires only basic privileges and minimal bind operations, making it a high-impact issue for any RabbitMQ deployment using JMS topics.

Compliance Impact

This vulnerability could lead to service disruptions, potentially violating availability requirements in GDPR, HIPAA, and other regulations. Downtime may result in non-compliance with uptime or data access guarantees mandated by these standards.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 or later to address the vulnerability. Disable the rabbitmq_jms_topic_exchange plugin if JMS functionality is not required. Restrict AMQP user permissions to limit access to x-jms-topic exchanges and queues.

Hi! I’m here to help you understand CVE-2026-67220. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70