{"id":"CVE-2026-67414","aliases":["BIT-rabbitmq-2026-67414","DEBIAN-CVE-2026-67414","EUVD-2026-101296","GHSA-w6mq-4qpx-v7mh","RHSA-2026:82703","UBUNTU-CVE-2026-67414"],"status":"published","title":"RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation","description":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.","severity":{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00631,"percentile":0.50597,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2026-10-14T16:04:07Z","modified":"2026-10-31T02:30:39Z","fixes":[{"ecosystem":"Bitnami","package":"rabbitmq","fixed_in":["4.0.24","4.1.15","4.2.10","4.3.4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rabbitmq-server","fixed_in":["4.3.6-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"rabbitmq","ranges":[{"type":"SEMVER","events":[{"introduced":"4.0.0"},{"fixed":"4.0.24"},{"introduced":"4.1.0"},{"fixed":"4.1.15"},{"introduced":"4.2.0"},{"fixed":"4.2.10"},{"introduced":"4.3.0"},{"fixed":"4.3.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.8-1.1","3.10.8-1.1+deb12u1","3.10.8-2","3.10.8-3","3.10.8-4","3.12.1-1","3.12.1-1.1","4.0.5-1","4.0.5-10","4.0.5-11","4.0.5-12","4.0.5-13","4.0.5-14","4.0.5-2","4.0.5-3","4.0.5-4","4.0.5-5","4.0.5-6","4.0.5-8","4.0.5-9","4.3.0-1","4.3.0-2","4.3.0-3","4.3.2-1","4.3.2-2","4.3.2-3","4.3.2-4","4.3.2-5","4.3.6-1"]},{"source":"osv","ecosystem":"Debian:13","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5-10","4.0.5-11","4.0.5-12","4.0.5-13","4.0.5-14","4.0.5-6","4.0.5-6+deb13u1","4.0.5-6+deb13u2","4.0.5-8","4.0.5-9","4.3.0-1","4.3.0-2","4.3.0-3","4.3.2-1","4.3.2-2","4.3.2-3","4.3.2-4","4.3.2-5","4.3.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-1"}]}],"versions":["4.0.5-10","4.0.5-11","4.0.5-12","4.0.5-13","4.0.5-14","4.0.5-6","4.0.5-8","4.0.5-9","4.3.0-1","4.3.0-2","4.3.0-3","4.3.2-1","4.3.2-2","4.3.2-3","4.3.2-4","4.3.2-5"]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rabbitmq-server4.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.6-1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.4-1","3.5.4-3","3.5.4-3.1","3.5.7-1","3.5.7-1ubuntu0.16.04.1","3.5.7-1ubuntu0.16.04.2","3.5.7-1ubuntu0.16.04.4","3.5.7-1ubuntu0.16.04.4+esm1","3.5.7-1ubuntu0.16.04.4+esm2","3.5.7-1ubuntu0.16.04.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.10-1","3.6.10-1ubuntu0.1","3.6.10-1ubuntu0.3","3.6.10-1ubuntu0.4","3.6.10-1ubuntu0.5","3.6.10-1ubuntu0.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.8-4ubuntu2","3.7.18-1","3.8.2-0ubuntu1","3.8.2-0ubuntu1.1","3.8.2-0ubuntu1.2","3.8.2-0ubuntu1.3","3.8.2-0ubuntu1.4","3.8.2-0ubuntu1.5","3.8.3-0ubuntu0.1","3.8.3-0ubuntu0.2","3.8.3-0ubuntu0.3","3.8.3-0ubuntu0.3+esm1","3.8.3-0ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.8.9-3ubuntu1","3.9.8-1","3.9.8-2","3.9.8-3","3.9.8-5","3.9.8-6","3.9.13-1","3.9.13-1ubuntu0.22.04.1","3.9.13-1ubuntu0.22.04.2","3.9.27-0ubuntu0.1","3.9.27-0ubuntu0.2","3.9.27-0ubuntu0.5","3.9.27-0ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.12.1-1","3.12.1-1ubuntu1","3.12.1-1ubuntu1.2","3.12.1-1ubuntu1.4","3.12.1-1ubuntu1.6","3.12.1-1ubuntu1.7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5-10ubuntu5","4.3.2-4ubuntu2","4.3.2-4ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rabbitmq-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.5-8ubuntu2","4.0.5-10ubuntu1","4.0.5-10ubuntu2","4.0.5-10ubuntu3","4.0.5-10ubuntu4","4.0.5-10ubuntu5","4.0.5-10ubuntu5.1","4.0.5-10ubuntu5.2"]}],"products":[{"vendor":"rabbitmq","product":"rabbitmq-server"}],"references":[{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6mq-4qpx-v7mh","tags":["x_refsource_CONFIRM","exploit","web","advisory","article","report"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/3f0f67dfb7c4390e3cbfa25ab3ee19dcb0845bd4","tags":["x_refsource_MISC","web","fix","article","report"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.4","tags":["x_refsource_MISC","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67414","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67414.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-67414","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82703","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67418","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67416","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-67414","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82703.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552665","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67414","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552574","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67416","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67416","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/c9b4b10c2dbf0f1c89f10b482ac8b45f84dc5954","tags":["article"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/d5186e66e056960f58e2d0fbee2fcc66e1ed6fb9","tags":["article"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/pull/17017","tags":["article"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/pull/17287","tags":["article"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-p35w-6mx2-q4pc","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552635","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-67418","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67418","tags":["advisory"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/4639a4318c72a0660e4bc014767fad70ce288fbc","tags":["article"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/commit/908f944a1d581d10774f8d6d0dcf2a1a713779fb","tags":["article"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/pull/17035","tags":["article"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5","tags":["article"]},{"url":"https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-jv99-v328-mvmm","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-67414","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-67414","title":"RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation","description":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.","status":"published","published":"2026-10-14T16:04:07.449Z","modified":"2026-10-29T14:19:15.193Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:20:06.562031Z"}],"euvd":[{"id":"EUVD-2026-101296","description":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.","status":"published","published":"2026-10-14T16:04:07Z","modified":"2026-10-29T14:19:15Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:16.484344Z"}],"nvd":[{"id":"CVE-2026-67414","description":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.","status":"published","published":"2026-10-14T16:17:50.703Z","modified":"2026-10-29T15:17:23.947Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:12:58.99337Z"}],"osv":[{"id":"CVE-2026-67414","title":"RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation","description":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.","status":"published","published":"2026-10-14T16:04:07.449Z","modified":"2026-10-31T02:30:39.499200719Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"DEBIAN-CVE-2026-67414","description":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.","status":"published","published":"2026-10-14T16:17:50.703Z","modified":"2026-10-30T09:49:18.948741927Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:01.68444Z"},{"id":"RHSA-2026:82703","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-17T10:21:05Z","modified":"2026-10-17T10:31:37.763172901Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-67414","description":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.","status":"published","published":"2026-10-14T16:17:00Z","modified":"2026-10-28T17:39:56Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:53.710209Z"},{"id":"BIT-rabbitmq-2026-67414","title":"RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation","description":"RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parser.erl materializes each element of AMQP 1.0 arrays whose shared constructor has zero width, while limiting only the number of elements in each array and not the aggregate arrays in a frame. After completing SASL authentication, a low-privilege client can send an ordinary frame containing many individually permitted arrays, causing a small frame to expand into a very large reader-process heap before later frame validation or authorization. Because deps/rabbit/src/rabbit_amqp_reader.erl clears the pre-authentication max_heap_size guard after login, repeated or concurrent frames can trigger the node-wide memory alarm, block publishers, or exhaust broker memory. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.","status":"published","published":"2026-10-21T08:59:26.976Z","modified":"2026-10-21T12:11:00.250932763Z","updated_at":"2026-11-02T15:28:35.111822Z"}]}}