CVE-2026-67232

Received Received - Intake

Memory Exhaustion via WebSocket Compression in RabbitMQ

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress => true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max_frame_size, so cowboy's default of infinity applies. cowlib's cow_ws:parse_payload/9 calls zlib:inflate/2 on the compressed payload with no output-size limit. An attacker can negotiate permessage-deflate during the WebSocket upgrade and send a frame containing a zlib bomb (e.g. 50 KB → 5 GB). Decompression occurs in the connection process before websocket_handle/2 ever sees the MQTT bytes. An unauthenticated attacker can crash a RabbitMQ node running the Web-MQTT plugin by sending a single highly-compressed WebSocket frame (a few KB on the wire) that inflates to gigabytes in memory. The cowboy WebSocket handler decompresses the entire frame before the MQTT CONNECT packet is processed, so no credentials are required. Preconditions include rabbitmq_web_mqtt plugin enabled (not default, but common for browser clients) Network reachability to port 15675/15676 No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-67232

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 3.13.15\|end_excluding=4.0.20\|end_excluding=4.1.11\|end_excluding=4.2.6\|end_excluding=4.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-409	The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ allows an unauthenticated attacker to crash a node by sending a highly-compressed WebSocket frame. The issue occurs because the WebSocket handler decompresses the entire frame before processing, enabling a zlib bomb attack where a small payload inflates to gigabytes in memory.

Detection Guidance

Detecting this vulnerability requires checking if the rabbitmq_web_mqtt plugin is enabled and if WebSocket compression is active. Inspect RabbitMQ logs for Web-MQTT connections and monitor for unusually large payloads. Use commands like 'rabbitmq-plugins list' to check plugin status and 'netstat -tulnp | grep 15675' to verify network exposure.

Impact Analysis

An attacker could exploit this to cause a denial of service by crashing RabbitMQ nodes, disrupting messaging services. Systems using the Web-MQTT plugin are vulnerable if network reachable and no authentication is required.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 or later. Disable the rabbitmq_web_mqtt plugin if not needed using 'rabbitmq-plugins disable rabbitmq_web_mqtt'. Restrict network access to ports 15675/15676 via firewall rules. Enable authentication for Web-MQTT connections if possible.

Hi! I’m here to help you understand CVE-2026-67232. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70