CVE-2026-57220: RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while…

PriorityP349high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.52%

40.4th percentile

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remote client to declare oversized frame lengths and consume broker memory in rabbit_stream_core. This issue is fixed in version 4.2.6.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
broadcom	rabbitmq_server	< 4.2.6	4.2.6
rabbitmq	rabbitmq-server	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.