CVE-2026-67414: RabbitMQ Memory Exhaustion DoS via Zero-Width Array Aggregation
Summary
CVE-2026-67414: RabbitMQ AMQP 1.0 parser: amplification memory-exhaustion DoS via zero-width array aggregation. Affects rabbitmq across 4 version ranges.
>= 4.0.0, < 4.0.24
>= 4.1.0, < 4.1.15
>= 4.2.0, < 4.2.10
>= 4.3.0, < 4.3.4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RabbitMQ is a widely-used messaging and streaming broker that facilitates communication between different applications through message queuing. It supports multiple messaging protocols, including AMQP, and is known for its reliability and scalability. However, certain versions of RabbitMQ are vulnerable to a memory exhaustion denial-of-service (DoS) attack due to improper handling of AMQP 1.0 arrays, which can lead to significant resource depletion.
Vulnerability Detail
The vulnerability arises from the RabbitMQ AMQP 1.0 parser, which incorrectly materializes each element of AMQP 1.0 arrays with a zero-width shared constructor. This flaw allows a low-privilege client to send a frame containing multiple permitted arrays, causing a small frame to expand into a large heap in the reader process. After SASL authentication, the pre-authentication max_heap_size guard is cleared, enabling repeated or concurrent frames to trigger node-wide memory alarms, block publishers, or exhaust broker memory. This issue can lead to service disruptions and degraded performance.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.0.244.0.24 -
>= 4.1.0, < 4.1.154.1.15 -
>= 4.2.0, < 4.2.104.2.10 -
>= 4.3.0, < 4.3.44.3.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing strict input validation to limit the number of arrays a low-privilege client can send. Additionally, monitor memory usage closely to detect any unusual spikes that may indicate an attempted exploitation of this vulnerability.
Conclusion
The RabbitMQ vulnerability CVE-2026-67414 poses a significant risk of memory exhaustion denial-of-service attacks through improper handling of AMQP 1.0 arrays. It is crucial to update to the patched versions to mitigate this risk and ensure the stability of your messaging services.
See every vulnerability recorded for rabbitmq →
FAQ
The affected versions are RabbitMQ 4.0.0 to 4.0.24, 4.1.0 to 4.1.15, 4.2.0 to 4.2.10, and 4.3.0 to 4.3.4.
Exploitation of this vulnerability can lead to memory exhaustion, blocking publishers, and overall service disruption.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, implementing strict input validation and monitoring memory usage can help mitigate the risk until you can apply the patch.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights into potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for rabbitmq.
