Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67232)
Description
CVE-2026-67232 is a vulnerability in RabbitMQ server's Web-MQTT plugin where the WebSocket handler enables compression without limiting decompression size. This allows an unauthenticated attacker to send a specially crafted compressed WebSocket frame that inflates to a very large size in memory, causing a denial of service by crashing the RabbitMQ node. The issue affects versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. The vulnerability requires the rabbitmq_web_mqtt plugin to be enabled and network access to ports 15675 or 15676. A fix is available in the stated versions.
CVSS v4.0
Affected software
pkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=jammypkg:deb/ubuntu/rabbitmq-server?arch=source&distro=noblepkg:deb/ubuntu/rabbitmq-server?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RabbitMQ's Web-MQTT plugin prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 enables permessage-deflate compression in the cowboy WebSocket handler without setting a maximum frame size. This allows an attacker to negotiate compression and send a compressed payload (zlib bomb) that decompresses to gigabytes of data in memory, causing the RabbitMQ node to crash. The decompression occurs before MQTT CONNECT packet processing, so no authentication is required. The vulnerability requires the rabbitmq_web_mqtt plugin to be enabled and network reachability to the WebSocket ports. The issue is fixed in the specified versions.
Potential Impact
An unauthenticated attacker can cause a denial of service by crashing a RabbitMQ node running the Web-MQTT plugin via a single specially crafted compressed WebSocket frame. This can lead to service disruption without requiring any credentials or prior authentication.
Mitigation Recommendations
A patch is available and should be applied by upgrading RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 or later. The vendor advisory confirms the fix. If upgrading is not immediately possible, consider disabling the rabbitmq_web_mqtt plugin or restricting network access to ports 15675 and 15676 to trusted sources until patched.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-67232
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
- State
- PUBLISHED
Patch Information
Threat ID: 6ad3f5aa2cdf04f6566627f1
Added to database: 10/17/2026, 22:24:42 UTC
Last enriched: 10/18/2026, 00:02:47 UTC
Last updated: 10/18/2026, 00:02:47 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.