CVE-2026-67232

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

CVE-2026-67232 RabbitMQ: Web-MQTT decompression bomb

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

CVE-2026-67232 RabbitMQ: Web-MQTT decompression bomb

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

CVE-2026-67219 RabbitMQ: Consistent-hash exchange unbounded weight

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addbinding/3 parses the routing key as an integer weight N and computes ring positions with lists:seqNextN0, NextN0 + N - 1. validatebinding/2 only checks N = 1 , no upper bound. The resulti...

CVE-2026-67219

RabbitMQ is affected by a vulnerability where the add_binding/3 function fails to impose an upper bound on the routing key integer weight N in the consistent-hash exchange plugin. Because validate_binding/2 only ensures N >= 1 , an attacker with write permissions on a consistent-hash exchange ...

CVE-2026-67219 RabbitMQ: Consistent-hash exchange unbounded weight

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addbinding/3 parses the routing key as an integer weight N and computes ring positions with lists:seqNextN0, NextN0 + N - 1. validatebinding/2 only checks N = 1 , no upper bound. The resulti...

CVE-2026-67219

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addbinding/3 parses the routing key as an integer weight N and computes ring positions with lists:seqNextN0, NextN0 + N - 1. validatebinding/2 only checks N = 1 , no upper bound. The resulti...

CVE-2026-67228

RabbitMQ versions prior to 4.2.7 and 4.3.1 are vulnerable to an atom exhaustion attack in the runtime-parameters lookup path. The lookup_component/1 function in deps/rabbit/src/rabbit_runtime_parameters.erl incorrectly uses rabbit_data_coercion:to_atom/1 to process the :component segment of a req...

CVE-2026-67228

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbitdatacoercion:toatom/1 in lookupcomponent/1 deps/rabbit/src/rabbitruntimeparameters.erl, creating a new atom for any previous...

CVE-2026-67235

RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize a uint64 was stored without validation against maxmessagesize. The size check ran only when assembly completed. By declaring bodysize = 2^63-1 and then streaming...

CVE-2026-67235 RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size

RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize a uint64 was stored without validation against maxmessagesize. The size check ran only when assembly completed. By declaring bodysize = 2^63-1 and then streaming...

CVE-2026-67235

The messaging and streaming broker RabbitMQ is vulnerable to a memory exhaustion flaw in versions prior to 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15 . The AMQP 0-9-1 protocol's body assembly process fails to validate the BodySize content-header against max_message_size until assembly is complete....

CVE-2026-67235 RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size

RabbitMQ is a messaging and streaming broker. Prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15, The content-header BodySize a uint64 was stored without validation against maxmessagesize. The size check ran only when assembly completed. By declaring bodysize = 2^63-1 and then streaming...

CVE-2026-67229

RabbitMQ, a messaging and streaming broker, is vulnerable to a Denial of Service (DoS) condition in versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. The add_vhost/2 function calls the unsafe rabbit_data_coercion:atomize_keys/1 variant using binary_to_atom on the vhost metadata map. An...

CVE-2026-67229

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addvhost/2 calls rabbitdatacoercion:atomizekeys/1 the unsafe variant using binarytoatom on the vhost metadata map. The 20 MB management body limit fits 1M+ short keys. Admin-only. An...

CVE-2026-67229 RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addvhost/2 calls rabbitdatacoercion:atomizekeys/1 the unsafe variant using binarytoatom on the vhost metadata map. The 20 MB management body limit fits 1M+ short keys. Admin-only. An...

CVE-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

CVE-2026-66080

The messaging broker RabbitMQ is vulnerable to an unbounded memory allocation issue in the validate_partitions function. Prior to versions 4.1.11, 4.2.6, and 4.3.0 , the system fails to enforce an upper bound on the requested partition count, allowing a large count (e.g., 500,000,000) to allocate...

CVE-2026-66080

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...

CVE-2026-66080 RabbitMQ: Super-stream partitions unbounded allocation

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq0, 500000000 allocates roughly 8GB. Preconditions include The...