RabbitMQ EUVD-2026-101419

Requires an authenticated MQTT client that both connects over MQTT 5 and holds write permission on a topic that at least one other client is subscribed to; the attacker must send a PUBLISH packet containing the Request-Problem-Information property (property id valid only on CONNECT). Exploitation is bounded by several limiting factors: valid broker credentials and topic-write authorization are mandatory (PR:L), the rabbitmq_mqtt plugin must be enabled with MQTT 5 in use, a matching subscriber must exist for the crash to occur, and impact is confined to dropping that single victim MQTT/Web MQTT connection - the broker, the publisher connection, and other clients remain available. Affected only in 3.13.0 through 3.13.18 (and the 4.x lines prior to the fixed releases).

This is a genuinely medium/low-priority issue, and the signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) scores 5.3 (Medium), which accurately reflects the constrained impact: no confidentiality or integrity loss and only LOW availability impact. Crucially, PR:L confirms exploitation requires an authenticated publisher holding topic write permission - this is not an unauthenticated remote flaw despite AV:N. The description itself bounds the damage: only the targeted, separately-authenticated subscriber's MQTT/Web MQTT connection is dropped via an uncontained function_clause exception; the publisher connection and the broker as a whole stay available, and the vendor explicitly states that queued replay, retained-message persistence, and broker-wide denial of service were NOT established. No EPSS score was provided, there is no CISA KEV listing, and no public exploit was supplied - the GitHub 'source code evidence' is the vendor patch (PR #17035), not weaponized exploit code, so it must not be counted as POC availability. Net: a real but low-severity, authenticated, single-victim connection-DoS, not an urgent patch-now emergency.

An attacker who already has valid broker credentials and write permission to a topic publishes an MQTT 5 PUBLISH packet carrying the Request-Problem-Information property, which is only legal on CONNECT. The broker stores and routes the malformed property; when it serializes the outbound PUBLISH to a matching subscriber, serialise_prop/2 has no clause for it and crashes that subscriber's connection. No public exploit code was identified, but the trigger is trivial to craft given the low attack complexity (AC:L).