RabbitMQ versions before 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15 improperly handle the content-header BodySize (a uint64) by not validating it against max_message_size until message assembly completes. An attacker can declare an extremely large body_size (2^63-1) and stream fragments to bypass the size check, causing the reader process to accumulate memory without bounds. This leads to memory exhaustion, triggering memory alarms that degrade cluster-wide publishing or cause node crashes. The vulnerability requires an authenticated AMQP 0-9-1 client with publish permission. The issue is addressed in the fixed versions listed.

Exploitation allows an authenticated AMQP 0-9-1 client with publish permission to cause unbounded memory allocation on a RabbitMQ node. This can degrade the performance of all publishers cluster-wide or cause the node to run out of memory, potentially leading to denial of service. The memory alarm provides only partial mitigation as it is reactive rather than preventive.

This vulnerability is fixed in rabbitmq-server versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15. Users should upgrade to these or later versions to remediate the issue. No additional mitigation is required if running patched versions.