CVE-2026-67408

🗓️ 25 Sep 2026 16:35:22Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 27 Views🌐 WEB

Low-privileged authenticated users can cause DoS in RabbitMQ Stream Management via binding-keys.

Reporter	Title	Published	Views	Family All 19
Cvelist	CVE-2026-67408 RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service	25 Sep 202616:35	–	cvelist
Debian CVE	CVE-2026-67408	25 Sep 202616:35	–	debiancve
EUVD	EUVD-2026-87241	25 Sep 202616:35	–	euvd
Mend	CVE-2026-67408	25 Sep 202616:35	–	mend
NVD	CVE-2026-67408	25 Sep 202617:17	–	nvd
osv_bit	BIT-RABBITMQ-2026-67408 RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service	1 Oct 202609:33	–	osv_bit
osv_debian	DEBIAN-CVE-2026-67408	25 Sep 202617:17	–	osv_debian
osv_rhsa	RHSA-2026:67552 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update	22 Sep 202610:18	–	osv_rhsa
osv_ubuntu	UBUNTU-CVE-2026-67408	25 Sep 202617:17	–	osv_ubuntu
Positive Technologies	PT-2026-105194	1 Oct 202600:00	–	ptsecurity

NVD

Vulners

Node

broadcom rabbitmq_serverRange4.1.0–4.1.11

broadcom rabbitmq_serverRange4.2.0–4.2.9

broadcom rabbitmq_serverRange4.3.0–4.3.3

[
  {
    "vendor": "rabbitmq",
    "product": "rabbitmq-server",
    "versions": [
      {
        "version": ">= 4.3.0, < 4.3.3",
        "status": "affected"
      },
      {
        "version": ">= 4.2.0, < 4.2.9",
        "status": "affected"
      },
      {
        "version": ">= 4.1.0, < 4.1.11",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8
github	www.github.com/rabbitmq/rabbitmq-server/commit/eb11bc44005fd6d327a78bf171bc598207778c9b
github	www.github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3
github	www.github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9
github	www.github.com/rabbitmq/rabbitmq-server/commit/0f3defd176e027f54f447beee168d906d4f109b6

Parameter	Position	Path	Description	CWE
binding-keys	request body	/api/stream/super-streams/{vhost}/{name}	Attacker-controlled binding-keys in the PUT body can trigger large transient allocations before permission checks, enabling DoS by a low-privilege management user with vhost access.	CWE-400

08 Oct 2026 15:33Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.16.5

CVSS 47.1

EPSS0.00445

CWE-400