Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67240)

RabbitMQ server versions before 4.2.7 and 4.3.1 contain a vulnerability in the pattern_to_regex function used for LIKE filters in AMQP 1.0 stream queues. The function maps SQL LIKE wildcards '%' and '_' to regex patterns with overlapping lazy quantifiers, which can cause excessive backtracking and CPU usage when processing messages. An authenticated AMQP 1.0 consumer with read and write permissions on a stream queue can exploit this by attaching a receiver with a crafted filter and publishing messages with long property values, causing approximately 100-200 ms of CPU time per message. This CPU amplification can be multiplied across many messages and parallel sessions, leading to substantial resource consumption. The issue is mitigated by OTP's default match_limit and the re NIF scheduler yielding, but still represents a significant CPU amplification attack vector. The vulnerability is fixed in RabbitMQ versions 4.2.7 and 4.3.1.

An attacker with authenticated AMQP 1.0 consumer access and read+write permissions on a stream queue can cause substantial CPU resource consumption on the RabbitMQ server by exploiting crafted LIKE filters that trigger excessive regex backtracking. This can degrade server performance and potentially lead to denial of service conditions under high message volume and parallel sessions.

This vulnerability is fixed in RabbitMQ versions 4.2.7 and 4.3.1. Users should upgrade to these or later versions to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.