Skip to main content

RabbitMQ EUVDEUVD-2026-87145

| CVE-2026-67225 MEDIUM
Allocation of Resources Without Limits or Throttling (CWE-770)
2026-09-25 GitHub_M
Denial Of Service Rabbitmq Server Suse Erlang Rabbitmq
6.3
CVSS 4.0 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Connect to stream protocol listener
  2. Delivery
    Complete Tune handshake
  3. Exploit
    Declare oversized frame length
  4. Execution
    Server buffers unbounded frame
  5. Impact
    Memory exhaustion and broker DoS

Vulnerability Assessment

Weakness
CWE
CWE-770
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK

1 technique across 1 tactic: Impact

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires the RabbitMQ stream plugin to be enabled and its stream protocol listener reachable by the attacker; this is a non-default component that must be explicitly activated. Exploitation is remote and unauthenticated (PR:N) at the protocol level: the attacker completes the stream Tune handshake and then declares a frame whose length exceeds the negotiated FrameMax. Limiting factors: only affects deployments running the stream plugin, impact is availability-only (memory pressure/DoS with no data exposure), and affected versions are the 3.13.0-3.13.15 / 4.0.x-pre-4.0.20 / 4.1.x-pre-4.1.11 / 4.2.x-pre-4.2.6 ranges.
Impact

This is a genuine but low-to-moderate-severity denial-of-service issue, not a high-impact priority. The provided CVSS 4.0 vector (6.3, AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) is internally consistent with the description: network-reachable, low complexity, no privileges, but the AT:P (attack requirement) correctly reflects that the stream plugin must be enabled - this is not a default-on component for every RabbitMQ deployment. Impact is confined to availability (VA:L / partial), with no confidentiality or integrity impact, matching CWE-770 (uncontrolled resource allocation). There is no EPSS score, no CISA KEV listing, and no public exploit code identified in the provided data, so exploitation is currently theoretical. The signals are aligned rather than conflicting: modest CVSS, availability-only impact, and a configuration precondition all point to a real-but-bounded issue. Treat as routine patching for deployments that actually run the stream plugin; deprioritize for those that do not.
Exploit ScenarioDerived

A remote client connects to the RabbitMQ stream protocol listener, completes the Tune handshake, then sends a frame whose declared length far exceeds the negotiated FrameMax value. Because the server buffers the frame without validating its declared length against FrameMax, repeated oversized-frame declarations drive excessive memory allocation, degrading or crashing the broker. No public proof-of-concept is identified in the provided data.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

A remote, unauthenticated denial-of-service condition exists in the RabbitMQ stream protocol when the stream plugin is enabled, allowing a client that completes the Tune handshake to declare a frame larger than the negotiated FrameMax and drive excessive memory consumption. Affected deployments are RabbitMQ 3.13.0 through 3.13.14, 4.0.x before 4.0.20, 4.1.x before 4.1.11, and 4.2.x before 4.2.6; the issue is availability-only with no confidentiality or integrity impact, and exploitation requires the non-default stream plugin (and its listener) to be exposed to the attacker. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV) associated with this CVE. Independent assessment rates this as a genuine but low-to-moderate-severity DoS issue rather than a high-impact priority.

RemediationAI

Upgrade to a fixed release: RabbitMQ 3.13.15, 4.0.20, 4.1.11, or 4.2.6 (vendor-released patch), selecting the line that matches your current release series; consult the vendor advisory at https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c8c4-gvv4-8j3q and the release notes at https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6, and note that nodes will fail to start on unsupported Erlang/OTP versions so validate the compatibility matrix before upgrading. If immediate patching is not possible, the most effective compensating control is to disable the stream plugin (rabbitmq-plugins disable rabbitmq_stream) on any node that does not require it, at the cost of losing stream functionality; alternatively, restrict the stream protocol listener (default TCP 5552) to trusted networks via firewall or security-group rules, accepting that this only protects deployments where legitimate stream clients originate from known address ranges. Operators can also impose connection and resource limits and monitor node memory for abnormal growth as a detection measure, but these are not substitutes for the patched versions since the missing FrameMax bounds check remains in vulnerable builds.

Affected VersionsENISA

rabbitmq-server 4.1.0, < 4.1.11
rabbitmq-server 3.13.0, < 3.13.15
rabbitmq-server 4.2.0, < 4.2.6
rabbitmq-server 4.0.0, < 4.0.20

Affected Packages

euvd rabbitmq_server_3_13_0 fix: 3.13.15
euvd rabbitmq_server_4_0_0 fix: 4.0.20
euvd rabbitmq_server_4_1_0 fix: 4.1.11
euvd rabbitmq_server_4_2_0 fix: 4.2.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

RabbitMQ is an Erlang/OTP-based messaging and streaming broker; the affected subsystem is the stream protocol used by the stream plugin rather than the default AMQP 0-9-1 or AMQP 1.0 listeners. During connection establishment the stream protocol performs a Tune handshake in which both peers negotiate parameters including FrameMax, the maximum permitted frame size. Per CWE-770 (Allocation of Resources Without Limits or Throttling), the broker stored the negotiated FrameMax value but did not validate an inbound frame's declared length against it before allocating and buffering the frame, so an oversized length declaration translated directly into unbounded memory pressure. The root cause is therefore a missing bounds check tied to a protocol-level limit that was known to the server, which makes the flaw a resource-exhaustion class issue driven entirely by attacker-controlled framing rather than by any memory-safety defect. The CPE string cpe:2.3:a:rabbitmq:rabbitmq-server:*:*:*:*:*:*:*:* confirms the RabbitMQ server package as the affected product across the vulnerable release trains.

Know when Rabbitmq gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 6.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
vuln.today AI 5.3 MEDIUM

Remote unauthenticated at protocol level (AV:N/PR:N/UI:N); simple oversized-frame trigger (AC:L); availability-only memory-pressure DoS (A:L), no C/I impact; stream-plugin precondition noted but not scored in 3.1.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch available
Sep 25, 2026 - 17:04 EUVD
CVE Published
Sep 25, 2026 - 16:02 cve.org
MEDIUM 6.3

DescriptionCVE.org

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tune handshake but did not compare it with an inbound frame's declared length before buffering the frame. With the stream plugin enabled, a remote client could therefore cause excessive memory pressure and denial of service by declaring an oversized frame. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Threat Intelligence Overview

EPSS Score
0.3%
Top 77% exploitable
Prevalence
High
RabbitMQ is a widely deployed enterprise messaging broker across many production stacks
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact· derived
Medium
Technical Impact
Partial

Priority Score

32
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +32
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Rabbitmq

View all
CVE-2026-57219 HIGH POC
8.7 Jul 10

Sensitive credential disclosure in RabbitMQ affects installations running the management plugin with OAuth 2 configured

CVE-2019-11287 HIGH POC
7.5 Nov 23

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x ver
CVE-2026-63335 MEDIUM POC
6.3 Aug 18

Denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.30.0) allows a malicious or compromi
CVE-2016-9877 CRITICAL
9.8 Dec 29

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.
CVE-2026-77411 CRITICAL
9.5 Sep 16

Parsing desynchronization in the RabbitMQ amqp091-go AMQP 0.9.1 client library before 1.13.0 lets a malicious or comprom
CVE-2026-77405 CRITICAL
9.4 Sep 16

RabbitMQ's amqp091-go Go client library, in all versions before 1.13.0, builds TLS configuration from amqps:// URIs with
CVE-2021-32718 MEDIUM POC
5.4 Jun 28

RabbitMQ is a multi-protocol messaging broker. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploita
CVE-2026-67404 CRITICAL
9.2 Sep 23

RabbitMQ brokers that use the OAuth2 plugin can silently fall back to disabled TLS certificate verification when no CA b
CVE-2026-77408 CRITICAL
9.1 Sep 16

Silent AMQP 0.9.1 metadata corruption in the RabbitMQ amqp091-go Go client library prior to 1.13.0 lets an application t
CVE-2026-67231 CRITICAL
9.1 Sep 23

TLS client-authentication bypass in the RabbitMQ trust-store plugin lets a remote unauthenticated attacker whose forged

CVE-2026-63336 MEDIUM POC
5.1 Aug 18

TLS certificate validation is completely bypassed in the RabbitMQ Java client library (`com.rabbitmq:amqp-client`) prior
CVE-2026-77412 HIGH
8.9 Sep 16

Denial of service in the official RabbitMQ Go client library amqp091-go (versions prior to 1.13.0): a malicious, comprom

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2024-28182 MEDIUM
5.3
CVE-2023-2650 MEDIUM
6.5
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2022-32206 MEDIUM POC
6.5
CVE-2023-24998 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Module for Server Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected

References

Advisories & patches
REF https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 REF https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c8c4-gvv4-8j3q

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy