CVE-2026-66079
published 2026-09-23CVE-2026-66079: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0)…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.32%
23.4th percentile
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | rabbitmq_server | >= 3.13.0 < 3.13.15 | 3.13.15 |
| broadcom | rabbitmq_server | >= 4.0.0 < 4.0.20 | 4.0.20 |
| broadcom | rabbitmq_server | >= 4.1.0 < 4.1.11 | 4.1.11 |
| broadcom | rabbitmq_server | >= 4.2.0 < 4.2.6 | 4.2.6 |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| ubuntu | rabbitmq-server | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.2HIGH
vendor_ubuntu7.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
RabbitMQ Server vulnerabilities
vendor_ubuntu·2026-10-15·CVSS 7.6
CVE-2026-67404 [HIGH] RabbitMQ Server vulnerabilities
Title: RabbitMQ Server vulnerabilities
Summary: Several security issues were fixed in RabbitMQ Server.
It was discovered that RabbitMQ Server incorrectly handled CORS wildcard
origin configuration. An attacker could possibly use this issue to cause
a cross-site request forgery attack. This issue only affected Ubuntu 18.04
LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04
LTS. (CVE-2026-66070)
It was discovered that RabbitMQ Server incorrectly handled TLS
peer-certificate DNs in the management UI. An attacker could possibly use
this issue to cause a cross-site scripting attack. (CVE-2026-66077)
It was discovered that RabbitMQ Server incorrectly handled AMQP 1.0 arrays
with zero-width element constructors. An attacker could possibly use this
issue to cause a den
Red Hat
rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing
vendor_redhat·2026-09-23·CVSS 8.2
CVE-2026-66079 [HIGH] CWE-770 rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing
rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is ac
VulDB
RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5 AMQP 1.0 Framing Parser rabbit_amqp_reader.erl parse_array_primitive Count resource consumption
vuldb·2026-09-23·CVSS 8.2
CVE-2026-66079 [HIGH] RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5 AMQP 1.0 Framing Parser rabbit_amqp_reader.erl parse_array_primitive Count resource consumption
A vulnerability was found in RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5. It has been classified as problematic. Affected by this vulnerability is the function parse_array_primitive of the file rabbit_amqp_reader.erl of the component AMQP 1.0 Framing Parser. The manipulation of the argument Count leads to resource consumption.
This vulnerability is documented as CVE-2026-66079. The attack can be initiated remotely. There is not any exploit available.
Upgrading the affected component is recommended.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-66079 rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing [fedora-all]
bugzilla·2026-09-24·CVSS 8.2
CVE-2026-66079 [HIGH] CVE-2026-66079 rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing [fedora-all]
CVE-2026-66079 rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init fram
Bugzilla
CVE-2026-66079 rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing
bugzilla·2026-09-23·CVSS 8.2
CVE-2026-66079 [HIGH] CVE-2026-66079 rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing
CVE-2026-66079 rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0
2026-09-23
Published