CVE-2026-67235

Received Received - Intake

Memory Exhaustion in RabbitMQ via Unbounded Body Size

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize (a uint64) was stored without validation against max_message_size. The size check ran only when assembly completed. By declaring body_size = 2^63-1 and then streaming fragments, a client ensured that check_msg_size never fired, so the accumulated body size went unbounded. A reader process accumulates memory until the memory alarm fires, degrading all publishers cluster-wide, or until the node runs out of memory. The memory alarm provides only partial mitigation, since it is reactive rather than preventive. AMQP 0-9-1 is the most widely used protocol, and any publisher can trigger this condition. Preconditions include Any authenticated AMQP 0-9-1 client with publish permission can exploit this.. This issue is fixed in versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-67235

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.3.0\|end_excluding=4.2.6\|end_excluding=4.1.11\|end_excluding=4.0.20\|end_excluding=3.13.15 (exc)
rabbitmq	rabbitmq	to 4.3.0\|end_including=4.2.6\|end_including=4.1.11\|end_including=4.0.20\|end_including=3.13.15 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

RabbitMQ is a messaging broker vulnerable to a memory exhaustion issue in versions before 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15. Attackers can declare an extremely large body size (2^63-1) and stream fragments without triggering size checks until memory is exhausted. This causes memory alarms to fire, degrading performance or crashing the system.

Detection Guidance

Monitor RabbitMQ memory usage and node health. Check for processes consuming excessive memory or triggering memory alarms. Use RabbitMQ management plugin or CLI commands like 'rabbitmqctl status' to inspect node metrics. Look for clients publishing large message fragments or declaring unusually large body sizes.

Impact Analysis

This vulnerability allows any authenticated AMQP 0-9-1 client with publish permissions to crash RabbitMQ nodes or degrade cluster-wide performance by consuming excessive memory. It can lead to denial-of-service conditions, disrupting message processing and affecting all connected clients.

Mitigation Strategies

Upgrade RabbitMQ to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, or 3.13.15 or later. Restrict publish permissions to trusted clients. Set max_message_size to a reasonable limit in RabbitMQ configuration. Monitor memory usage and enable memory alarms to prevent node degradation.

Hi! I’m here to help you understand CVE-2026-67235. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70