Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-66079)

RabbitMQ's AMQP 1.0 listener improperly parses the SASL-mechanisms / SASL-init frame before authentication completes. Specifically, the parse_array_primitive/2 function for constructor 0x45 (list0) returns elements with zero byte-width, but the enclosing array32 parser loops based on a 4-byte Count field from the wire. An attacker can send a frame with a Count value of 0xFFFFFFFF, causing the parser to attempt to build a list of approximately 4 billion empty elements without consuming input, exhausting heap memory. This leads to termination of the Erlang VM and a denial of service on the node. No authentication is required to exploit this, and network reachability to the AMQP listener (default port 5672) is sufficient. The vulnerability is addressed in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

An unauthenticated remote attacker can cause a denial of service by crashing the RabbitMQ node running the AMQP 1.0 listener. This results in termination of the Erlang VM and loss of service for all tenants and protocols on the node. The attack requires only network access to the AMQP listener port (5672) and no authentication.

A fix is available and has been released in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. Users should upgrade to one of these versions or later to remediate this vulnerability. No additional mitigation is required if these versions are deployed.