CVE-2026-67232: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) in rabbitmq rabbitmq-server
CVE-2026-67232 is a high-severity vulnerability in rabbitmq-server affecting versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6. It involves improper handling of highly compressed WebSocket frames in the rabbitmq_web_mqtt plugin, allowing an unauthenticated attacker to cause a denial of service by sending a single compressed frame that inflates to gigabytes in memory. The vulnerability arises because the WebSocket handler decompresses frames without an output size limit, leading to resource exhaustion.
AI Analysis
Technical Summary
The vulnerability CVE-2026-67232 in rabbitmq-server is due to the cowboy WebSocket handler enabling permessage-deflate compression without setting a maximum frame size, resulting in unbounded decompression of WebSocket frames. An attacker can negotiate compression during the WebSocket upgrade and send a crafted compressed frame (a zlib bomb) that inflates massively in memory, causing the RabbitMQ node to crash. This occurs before any MQTT CONNECT packet processing and requires no authentication. The issue affects rabbitmq_web_mqtt plugin-enabled nodes reachable on ports 15675/15676. It is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Potential Impact
An unauthenticated attacker can cause a denial of service by crashing a RabbitMQ node running the rabbitmq_web_mqtt plugin. The attack exploits unbounded decompression of a compressed WebSocket frame, leading to excessive memory consumption and process crash. No credentials or prior authentication are required, and the attack can be performed remotely over the network on the affected ports.
Mitigation Recommendations
Upgrade rabbitmq-server to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or later where this issue is fixed. If upgrading is not immediately possible, consider disabling the rabbitmq_web_mqtt plugin or restricting network access to ports 15675/15676 to trusted clients until a patch can be applied.
CVE-2026-67232: CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) in rabbitmq rabbitmq-server
Description
CVE-2026-67232 is a high-severity vulnerability in rabbitmq-server affecting versions prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6. It involves improper handling of highly compressed WebSocket frames in the rabbitmq_web_mqtt plugin, allowing an unauthenticated attacker to cause a denial of service by sending a single compressed frame that inflates to gigabytes in memory. The vulnerability arises because the WebSocket handler decompresses frames without an output size limit, leading to resource exhaustion.
CVSS v4.0
Score 8.2high
Affected software
rabbitmq
rabbitmq-server
pkg:github/rabbitmq/rabbitmq-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-67232 in rabbitmq-server is due to the cowboy WebSocket handler enabling permessage-deflate compression without setting a maximum frame size, resulting in unbounded decompression of WebSocket frames. An attacker can negotiate compression during the WebSocket upgrade and send a crafted compressed frame (a zlib bomb) that inflates massively in memory, causing the RabbitMQ node to crash. This occurs before any MQTT CONNECT packet processing and requires no authentication. The issue affects rabbitmq_web_mqtt plugin-enabled nodes reachable on ports 15675/15676. It is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Potential Impact
An unauthenticated attacker can cause a denial of service by crashing a RabbitMQ node running the rabbitmq_web_mqtt plugin. The attack exploits unbounded decompression of a compressed WebSocket frame, leading to excessive memory consumption and process crash. No credentials or prior authentication are required, and the attack can be performed remotely over the network on the affected ports.
Mitigation Recommendations
Upgrade rabbitmq-server to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or later where this issue is fixed. If upgrading is not immediately possible, consider disabling the rabbitmq_web_mqtt plugin or restricting network access to ports 15675/15676 to trusted clients until a patch can be applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-28T19:50:39.438Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ab48379f7a7c54106b23ca1
Added to database: 09/24/2026, 01:57:13 UTC
Last enriched: 09/24/2026, 01:58:47 UTC
Last updated: 09/24/2026, 02:08:05 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.