CVE-2026-67414 RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10common/src/amqp10binaryparser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the...

CVE-2026-67414

The RabbitMQ messaging and streaming broker is vulnerable to a memory-exhaustion Denial of Service (DoS) in versions prior to 4.0.24, 4.1.15, 4.2.10, and 4.3.4 . The root cause is located in deps/amqp10_common/src/amqp10_binary_parser.erl, where the parser materializes elements of AMQP 1.0 arrays...