CVE-2026-67419

Undergoing Analysis Undergoing Analysis - In Progress

Authenticated User-Induced Denial of Service in RabbitMQ

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. The matcher materializes duplicate destinations before deduplication, causing combinatorial CPU work and memory pressure that can disrupt routing for all tenants. This vulnerability is fixed in 4.3.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67419

EUVD

EUVD-2026-87243

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.3.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CWE-1333	The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

Executive Summary

RabbitMQ is a messaging broker. This vulnerability allows an authenticated user to bind a queue to a topic exchange and publish messages with consecutive # segments in the binding key. This causes the topic matcher to revisit the same states repeatedly without optimization, leading to excessive CPU and memory usage. The issue is fixed in RabbitMQ version 4.3.5.

Detection Guidance

This vulnerability can be detected by checking the RabbitMQ version installed on your system. If the version is below 4.3.5, the system is vulnerable. Use the command 'rabbitmqctl status' or 'rabbitmq-diagnostics status' to check the version.

Impact Analysis

This vulnerability can disrupt message routing for all tenants by consuming excessive CPU and memory resources. It may lead to degraded performance, service outages, or denial of service for RabbitMQ deployments. Users running affected versions are at risk if an attacker exploits this issue.

Compliance Impact

This vulnerability causes resource exhaustion through CPU and memory pressure, which could disrupt system availability. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Upgrade RabbitMQ to version 4.3.5 or later to address the vulnerability. Ensure no unauthenticated users have access to bind queues or publish to topic exchanges.

Hi! I’m here to help you understand CVE-2026-67419. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70