Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67235)

RabbitMQ server versions before 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15 improperly handle the content-header BodySize (uint64) by deferring validation against max_message_size until message assembly completes. An attacker with authenticated AMQP 0-9-1 publish permissions can exploit this by setting body_size to 2^63-1 and streaming message fragments, bypassing the size check and causing unbounded memory growth in the reader process. This can trigger memory alarms or cause the node to run out of memory, degrading cluster performance. The vulnerability is addressed by validating BodySize earlier in the processing pipeline.

An authenticated AMQP 0-9-1 client with publish permissions can exploit this vulnerability to cause unbounded memory consumption on a RabbitMQ node, potentially leading to memory exhaustion and degradation of all publishers cluster-wide. The memory alarm provides only partial mitigation as it reacts after memory usage grows, not preventing the condition. This can impact availability and stability of the RabbitMQ cluster.

A fix is available in RabbitMQ versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15. Users should upgrade to these or later versions to fully remediate the vulnerability. The memory alarm feature provides partial, reactive mitigation but is not a substitute for patching. Refer to the official Ubuntu security notice USN-8933-1 for patch details.