RabbitMQ versions 4.1.0 up to but not including 4.1.11, 4.2.0 up to but not including 4.2.9, and 4.3.0 up to but not including 4.3.3 contain a resource consumption vulnerability in the Stream Management Super-Stream Binding Keys allocation logic. When the rabbitmqstreammanagement plugin is enabled, an authenticated management user with access to a vhost but lacking configure, write, or read permissions can send a PUT request to the /api/stream/super-streams/{vhost}/{name} endpoint containing a large binding-keys field. The server parses this attacker-controlled comma-separated string and builds a large list of stream names before checking permissions, resulting in excessive memory allocation. This can cause the RabbitMQ container or node to crash due to memory exhaustion. The issue is resolved in versions 4.1.11, 4.2.9, and 4.3.3.

An authenticated low-privileged management user with access to a target virtual host but without configure, write, or read permissions can cause a denial of service by exhausting memory resources on the RabbitMQ node. This can crash the RabbitMQ container or node, disrupting messaging and streaming services. The vulnerability does not allow privilege escalation or data access beyond the attacker's existing permissions.

This vulnerability is fixed in rabbitmq-server versions 4.1.11, 4.2.9, and 4.3.3. Users should upgrade to these or later versions to remediate the issue. No other mitigations are specified. Since this is not a cloud service, remediation requires applying the official patches.