CVE-2026-57220
published 2026-07-10CVE-2026-57220: RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while…
PriorityP348high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.55%
45.1th percentile
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remote client to declare oversized frame lengths and consume broker memory in rabbit_stream_core. This issue is fixed in version 4.2.6.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | rabbitmq_server | >= 4.2.0 < 4.2.6 | 4.2.6 |
| rabbitmq | rabbitmq-server | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rabbitmq-server: RabbitMQ: Denial of Service via oversized stream frames
vendor_redhat·2026-07-10·CVSS 7.5
CVE-2026-57220 [HIGH] CWE-770 rabbitmq-server: RabbitMQ: Denial of Service via oversized stream frames
rabbitmq-server: RabbitMQ: Denial of Service via oversized stream frames
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remote client to declare oversized frame lengths and consume broker memory in rabbit_stream_core. This issue is fixed in version 4.2.6.
A flaw was found in RabbitMQ. The stream listener in RabbitMQ does not properly enforce frame-size limits during authentication and before negotiation. This allows an unauthenticated remote client to send oversized stream frames, which can consume excessive broker memory. This can lead to a denial of service (DoS) condition, making the s
VulDB
RabbitMQ up to 4.2.5 Stream Listener resource consumption
vuldb·2026-07-10·CVSS 7.5
CVE-2026-57220 [HIGH] RabbitMQ up to 4.2.5 Stream Listener resource consumption
A vulnerability was found in RabbitMQ up to 4.2.5. It has been classified as problematic. This affects an unknown function of the component Stream Listener. The manipulation leads to resource consumption.
This vulnerability is uniquely identified as CVE-2026-57220. The attack is possible to be carried out remotely. No exploit exists.
No detection rules found.
No public exploits indexed.
https://github.com/rabbitmq/rabbitmq-server/commit/595ec28fa1621b1f2c28124e4e0466a8ad963547https://github.com/rabbitmq/rabbitmq-server/commit/773a49c4921e8be990262a2d609c35916825679ehttps://github.com/rabbitmq/rabbitmq-server/pull/16171https://github.com/rabbitmq/rabbitmq-server/pull/16173https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f364-87q5-j35qhttps://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f364-87q5-j35q
2026-07-10
Published