RabbitMQ EUVD-2026-101294

Requires an authenticated AMQP 1.0 publisher holding write permission to a target queue on RabbitMQ 4.0.0 through the fixed releases, using the optimized server_mode AMQP 1.0 parser. Impact is realized only when messages are consumed by a strict AMQP 1.0 consumer (which terminates while decoding the stored entry) or routed through AMQP 0-9-1 / other cross-protocol conversion that performs full body decoding; acknowledgement-required delivery amplifies the effect by redelivering the poisoned message and causing repeated consumer failures. Limiting factors: exploitation needs valid credentials with write permission (not unauthenticated), affects only consumer protocol processes rather than the broker (which stays alive), and sequence/value classifications are normally transported as opaque payloads so the data-misclassification path is the primary DoS vector.

This is a moderate-risk denial-of-service issue, not a high-priority emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 with only a Low availability impact (VA:L) and no confidentiality or integrity impact, which aligns well with the description: an authenticated AMQP 1.0 publisher can crash consumer protocol processes, but the broker itself stays alive and no routing or authorization is bypassed. The PR:L metric confirms exploitation requires an authenticated publisher with write permission, substantially limiting the attacker population to parties who already have legitimate access. No CISA KEV listing and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis'; the GitHub-provided source material is the vendor patch diff and regression tests, not weaponized exploit code. EPSS was not supplied. The one notable data conflict is the input Tag 'Authentication Bypass', which directly contradicts the description's explicit statement that the issue does NOT bypass authorization - this tag appears mislabeled and should be treated as a CWE-20 input-validation/DoS issue. Net: a real but bounded, authenticated-only availability bug that merits routine patching rather than emergency response.

An attacker who already holds AMQP 1.0 publisher credentials with write permission to a target queue publishes a well-formed but unknown descriptor whose bytes begin with a registered body descriptor prefix (e.g. 'amqp:data:binary@'), which the optimized server_mode parser misclassifies as a standard body section. When a strict AMQP 1.0 consumer or a cross-protocol (AMQP 0-9-1) conversion path then decodes the stored entry, the consumer's protocol process terminates; with acknowledgement-required delivery the poisoned message is redelivered, causing repeated crashes. No public proof-of-concept was provided, though the vendor patch includes regression tests demonstrating the prefix collision.