CVE-2026-67408

Analyzed Analyzed - Analysis Complete

Denial of Service in RabbitMQ Stream Management

Publication date: 2026-09-25

Last updated on: 2026-10-08

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-08

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67408

EUVD

EUVD-2026-87241

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	rabbitmq_server	From 4.1.0 (inc) to 4.1.11 (exc)
broadcom	rabbitmq_server	From 4.2.0 (inc) to 4.2.9 (exc)
broadcom	rabbitmq_server	From 4.3.0 (inc) to 4.3.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ versions 4.1.0 to 4.3.3, 4.2.9, and 4.1.11 allows an authenticated low-privilege management user to perform a denial of service attack. The issue occurs when the user sends a crafted HTTP PUT request to allocate super-stream binding keys. The system processes the request before verifying permissions, leading to excessive memory consumption and crashing the RabbitMQ node.

Detection Guidance

Check RabbitMQ management interface logs for unusual PUT requests to /api/stream/super-streams/{vhost}/{name} with large JSON bodies containing binding-keys. Monitor container or system memory usage spikes during management API interactions.

Impact Analysis

If exploited, this vulnerability can cause RabbitMQ servers to crash, disrupting messaging and streaming services. In a memory-limited environment, a single malicious request can kill the entire RabbitMQ container. This leads to service outages, data loss, and potential downtime for applications relying on RabbitMQ.

Compliance Impact

This vulnerability allows low-privilege users to perform denial-of-service attacks by forcing large memory allocations, potentially crashing RabbitMQ nodes. For compliance with GDPR or HIPAA, such disruptions could lead to service unavailability, impacting data processing or access, which may violate availability requirements under these regulations.

Mitigation Strategies

Upgrade RabbitMQ to versions 4.3.3, 4.2.9, or 4.1.11 or later. Restrict low-privilege management user permissions to prevent unauthorized super-stream binding key allocations. Limit memory allocation for RabbitMQ containers to mitigate impact of potential DoS.

Hi! I’m here to help you understand CVE-2026-67408. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70