CVE-2026-67414: CWE-400: Uncontrolled Resource Consumption in rabbitmq rabbitmq-server

RabbitMQ versions 4.0.0 up to but not including 4.0.24, 4.1.0 up to 4.1.15, 4.2.0 up to 4.2.10, and 4.3.0 up to 4.3.4 contain a vulnerability in deps/amqp10_common/src/amqp10_binary_parser.erl where each element of AMQP 1.0 arrays with zero-width shared constructors is materialized without limiting the aggregate arrays in a frame. After SASL authentication, a low-privilege client can send frames with many permitted arrays causing a small frame to expand into a very large reader-process heap. Because the pre-authentication max_heap_size guard is cleared after login, repeated or concurrent frames can trigger node-wide memory alarms, block publishers, or exhaust broker memory. This vulnerability is addressed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.

Exploitation allows a low-privilege client to cause uncontrolled memory consumption on the RabbitMQ broker node, potentially triggering memory alarms, blocking message publishers, or exhausting broker memory resources. This can degrade service availability and performance but does not directly indicate code execution or data compromise.

This vulnerability is fixed in rabbitmq-server versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4. Users should upgrade to these or later versions to remediate the issue. No additional mitigations are indicated by the vendor advisory.