RabbitMQ EUVD-2026-85627

Requires network reachability to the AMQP 1.0 listener on TCP port 5672, which is enabled by default in affected RabbitMQ 4.x deployments. No authentication and no user interaction are needed - the malicious SASL-mechanisms/SASL-init frame is parsed by amqp10_framing:decode_bin/1 (rabbit_amqp_reader.erl:412) BEFORE authentication completes. The only limiting factors are: (1) the AMQP 1.0 listener/plugin must be active (default-on), and (2) network path to port 5672 must exist - so nodes firewalled to trusted clients only, or with AMQP 1.0 disabled, are not exposed. No max_heap_size on the reader process is what allows the unbounded allocation; the pre-auth incoming_max_frame_size (default 8192) caps frame size but NOT the 32-bit Count field.

This is a genuine, high-priority pre-authentication denial-of-service in a widely deployed message broker. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms a remote, unauthenticated, low-complexity attack with a single ~19-byte frame, and the impact is availability-only (VA:H; VC:N/VI:N - no confidentiality or integrity loss, consistent with CWE-770 resource exhaustion). The vendor-assigned base score of 8.2 is driven entirely by the total availability loss (Erlang VM crash taking down all tenants and protocols on the node). No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so this is 'no public exploit identified at time of analysis' - but the description contains a precise, near-weaponizable technical walkthrough (constructor 0x45 list0 with B=0, array32 Count=0xFFFFFFFF), meaning exploit development is trivial for any capable attacker and the barrier is very low. The only conflicting/soft signal is the vendor's AT:P (attack-requirement present), which likely reflects that the AMQP 1.0 listener must be enabled; in RabbitMQ 4.x this listener is enabled by default on port 5672, so the practical requirement is minimal. Bottom line: real priority for any internet- or broadly-network-reachable RabbitMQ node, not a high-CVSS-but-low-real-risk case.

An unauthenticated attacker with network reachability to TCP 5672 sends a single crafted ~19-byte AMQP 1.0 SASL frame containing a list0 (0x45) element inside an array32 with Count=0xFFFFFFFF. The reader process, parsing before authentication, attempts to build ~4 billion empty list elements with no max_heap_size cap, exhausting heap and terminating the Erlang VM. No public POC is referenced, but the advisory's root-cause detail makes reproduction straightforward.