CVE-2026-66079: CWE-770: Allocation of Resources Without Limits or Throttling in rabbitmq rabbitmq-server
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
AI Analysis
Technical Summary
The vulnerability arises from the parse_array_primitive/2 function for constructor 0x45 (list0) returning an element with byte-width zero. The enclosing array32 parser reads a 4-byte Count from the network and loops Count times consuming zero bytes each iteration, effectively building a list of Count empty elements. Since the pre-authentication max frame size limits frame size but not the Count field, an attacker can send a frame with Count set to 0xFFFFFFFF (~4 billion), causing the reader process to exhaust heap memory and crash the Erlang VM. This affects any RabbitMQ node with the AMQP 1.0 listener enabled (default port 5672) and requires no authentication. The issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by crashing the Erlang VM running RabbitMQ, resulting in loss of service for all tenants and protocols on the affected node. This can be triggered by sending a single specially crafted frame to the AMQP 1.0 listener port (5672). The vulnerability does not require authentication and exploits resource exhaustion due to unbounded allocation.
Mitigation Recommendations
This vulnerability is fixed in rabbitmq-server versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. Users should upgrade to these or later versions to remediate the issue. Until patched, disabling the AMQP 1.0 listener or restricting network access to port 5672 can reduce exposure. Patch status is confirmed fixed in the stated versions.
CVE-2026-66079: CWE-770: Allocation of Resources Without Limits or Throttling in rabbitmq rabbitmq-server
Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
CVSS v4.0
Score 8.2high
Affected software
rabbitmq
rabbitmq-server
pkg:github/rabbitmq/rabbitmq-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from the parse_array_primitive/2 function for constructor 0x45 (list0) returning an element with byte-width zero. The enclosing array32 parser reads a 4-byte Count from the network and loops Count times consuming zero bytes each iteration, effectively building a list of Count empty elements. Since the pre-authentication max frame size limits frame size but not the Count field, an attacker can send a frame with Count set to 0xFFFFFFFF (~4 billion), causing the reader process to exhaust heap memory and crash the Erlang VM. This affects any RabbitMQ node with the AMQP 1.0 listener enabled (default port 5672) and requires no authentication. The issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Potential Impact
An unauthenticated remote attacker can cause a denial of service by crashing the Erlang VM running RabbitMQ, resulting in loss of service for all tenants and protocols on the affected node. This can be triggered by sending a single specially crafted frame to the AMQP 1.0 listener port (5672). The vulnerability does not require authentication and exploits resource exhaustion due to unbounded allocation.
Mitigation Recommendations
This vulnerability is fixed in rabbitmq-server versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. Users should upgrade to these or later versions to remediate the issue. Until patched, disabling the AMQP 1.0 listener or restricting network access to port 5672 can reduce exposure. Patch status is confirmed fixed in the stated versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-23T23:25:28.898Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab43089f7a7c54106431426
Added to database: 09/23/2026, 20:03:21 UTC
Last enriched: 09/23/2026, 20:18:25 UTC
Last updated: 09/24/2026, 01:57:04 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.