Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67408)

RabbitMQ versions 4.1.0 up to but not including 4.3.3, 4.2.9, and 4.1.11 have a vulnerability in the stream management super-stream binding keys allocation. An authenticated management user with limited privileges can send a PUT request to /api/stream/super-streams/{vhost}/{name} containing a binding-keys field with a large comma-separated string. The server parses this string and allocates memory for the resulting stream-name list before verifying permissions, enabling a low-privileged user to cause large transient memory allocations. This can crash RabbitMQ nodes running in memory-constrained containers, as demonstrated by a 4.5 MB JSON payload causing a container with 768 MB memory to exit.

An authenticated user with management access to a specific virtual host but without full permissions can cause a denial of service by crashing the RabbitMQ node due to excessive memory consumption. This impacts availability but does not affect confidentiality or integrity.

This issue is fixed in RabbitMQ versions 4.3.3, 4.2.9, and 4.1.11. Users should upgrade to one of these versions or later to remediate the vulnerability. No other mitigation or workaround is indicated by the vendor advisory.