CVE-2026-67416: CWE-20: Improper Input Validation in rabbitmq rabbitmq-server

RabbitMQ versions 4.0.0 through versions prior to 4.0.24, 4.1.15, 4.2.10, and 4.3.4 contain an input validation flaw in the optimized AMQP 1.0 server_mode parser (amqp10_binary_parser.erl). The parser matches textual prefixes of symbolic data, sequence, and value body descriptors without verifying encoded symbol lengths. An authenticated AMQP 1.0 publisher with write permissions can submit a crafted unknown descriptor that begins with a registered body descriptor, causing RabbitMQ to misclassify and store the bytes as a standard body section. Strict AMQP 1.0 consumers may terminate during decoding of this stored entry. Additionally, AMQP 0-9-1 or other cross-protocol conversions that fully decode the body can cause the consumer protocol process to terminate repeatedly if acknowledgements are required. The broker itself remains alive, and the vulnerability does not allow bypassing routing or authorization controls. The issue is resolved in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.

The vulnerability can cause AMQP 1.0 consumers or AMQP 0-9-1 consumer protocol processes to terminate unexpectedly when processing malformed descriptors, potentially leading to repeated failures in message consumption. However, the RabbitMQ broker remains operational, and there is no bypass of routing or authorization mechanisms. The impact is limited to denial of service on consumer processes rather than full broker compromise or data breach.

A fix is available in rabbitmq-server versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4. Users should upgrade to these or later versions to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.