CVE-2026-67414
published 2026-10-14CVE-2026-67414: RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes…
PriorityP338medium6CVSS 4.0
AVNACLATPPRLUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.54%
44.8th percentile
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
CVSS provenance
nvdv4.06.0MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rabbitmq-server: rabbitmq-server: Denial of Service via memory exhaustion in AMQP parser
vendor_redhat·2026-10-14·CVSS 6.0
CVE-2026-67414 [MEDIUM] CWE-770 rabbitmq-server: rabbitmq-server: Denial of Service via memory exhaustion in AMQP parser
rabbitmq-server: rabbitmq-server: Denial of Service via memory exhaustion in AMQP parser
A flaw was found in rabbitmq-server. This vulnerability allows an authenticated remote attacker to cause a Denial of Service (DoS) by exhausting broker memory. When processing Advanced Message Queuing Protocol (AMQP) messages, the parser fails to limit the aggregate number of array elements across an incoming frame, causing small requests to expand into disproportionately large memory allocations. By sending repeated crafted frames, an attacker can trigger system-wide memory alarms, block legitimate message publishing, and disrupt broker availability.
Package: rabbitmq-server4.2 (Red Hat Hardened Images) - Will not fix
Package: rabbitmq-server4.3 (Red Hat Hardened Images) - Affected
Package: rabbit
VulDB
VMware RabbitMQ up to 4.0.23/4.1.14/4.2.9/4.3.3 AMQP 1.0 Binary Parser amqp10_binary_parser.erl resource consumption (EUVD-2026-101296)
vuldb·2026-10-14·CVSS 6.0
CVE-2026-67414 [MEDIUM] VMware RabbitMQ up to 4.0.23/4.1.14/4.2.9/4.3.3 AMQP 1.0 Binary Parser amqp10_binary_parser.erl resource consumption (EUVD-2026-101296)
A vulnerability was found in VMware RabbitMQ up to 4.0.23/4.1.14/4.2.9/4.3.3. It has been rated as problematic. The affected element is an unknown function of the file deps/amqp10_common/src/amqp10_binary_parser.erl of the component AMQP 1.0 Binary Parser. Performing a manipulation results in resource consumption.
This vulnerability was named CVE-2026-67414. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
2026-10-14
Published