CVE-2026-67408

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-67408", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-29T15:02:20.411Z", "datePublished": "2026-09-25T16:35:22.829Z", "dateUpdated": "2026-09-25T19:09:53.750Z"}, "containers": {"cna": {"title": "RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/commit/0f3defd176e027f54f447beee168d906d4f109b6", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/0f3defd176e027f54f447beee168d906d4f109b6"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/commit/eb11bc44005fd6d327a78bf171bc598207778c9b", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/eb11bc44005fd6d327a78bf171bc598207778c9b"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9"}, {"name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3"}], "affected": [{"vendor": "rabbitmq", "product": "rabbitmq-server", "versions": [{"version": ">= 4.3.0, < 4.3.3", "status": "affected"}, {"version": ">= 4.2.0, < 4.2.9", "status": "affected"}, {"version": ">= 4.1.0, < 4.1.11", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-25T16:35:22.829Z"}, "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11."}], "source": {"advisory": "GHSA-2hm4-4438-49q8", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-25T19:09:46.402384Z", "id": "CVE-2026-67408", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T19:09:53.750Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-67408", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-25T19:09:46.402384Z"}}}], "references": [{"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-25T19:09:28.228Z"}}], "cna": {"title": "RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service", "source": {"advisory": "GHSA-2hm4-4438-49q8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "rabbitmq", "product": "rabbitmq-server", "versions": [{"status": "affected", "version": ">= 4.3.0, < 4.3.3"}, {"status": "affected", "version": ">= 4.2.0, < 4.2.9"}, {"status": "affected", "version": ">= 4.1.0, < 4.1.11"}]}], "references": [{"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8", "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/commit/0f3defd176e027f54f447beee168d906d4f109b6", "name": "https://github.com/rabbitmq/rabbitmq-server/commit/0f3defd176e027f54f447beee168d906d4f109b6", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/commit/eb11bc44005fd6d327a78bf171bc598207778c9b", "name": "https://github.com/rabbitmq/rabbitmq-server/commit/eb11bc44005fd6d327a78bf171bc598207778c9b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9", "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3", "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-09-25T16:35:22.829Z"}}}, "cveMetadata": {"cveId": "CVE-2026-67408", "state": "PUBLISHED", "dateUpdated": "2026-09-25T19:09:53.750Z", "dateReserved": "2026-07-29T15:02:20.411Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-09-25T16:35:22.829Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "rabbitmq-server", "vendor": "rabbitmq", "versions": [{"status": "affected", "version": ">= 4.3.0, < 4.3.3"}, {"status": "affected", "version": ">= 4.2.0, < 4.2.9"}, {"status": "affected", "version": ">= 4.1.0, < 4.1.11"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "01F24286-9982-4592-A370-70E55D6572D5", "versionEndExcluding": "4.1.11", "versionStartIncluding": "4.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "D35C2182-6B6E-4E76-98E7-6C928D64CCA8", "versionEndExcluding": "4.2.9", "versionStartIncluding": "4.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6CDECF0-FDCF-4C38-AD9D-F7B1F1246AEB", "versionEndExcluding": "4.3.3", "versionStartIncluding": "4.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11."}], "id": "CVE-2026-67408", "lastModified": "2026-10-08T15:33:05.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67408", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-25T19:09:46.402384Z", "version": "2.0.3"}}]}, "published": "2026-09-25T17:17:12.767", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/0f3defd176e027f54f447beee168d906d4f109b6"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/rabbitmq/rabbitmq-server/commit/eb11bc44005fd6d327a78bf171bc598207778c9b"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "rabbitmq-server: rabbitmq-server: Denial of Service via excessive memory allocation in stream management", "id": "2541516", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541516"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-408", "details": ["A flaw was found in rabbitmq-server. An authenticated user with access to a virtual host can cause a Denial of Service (DoS) by sending a specially crafted HTTP request to the stream management application programming interface (API). The server allocates substantial memory to process stream binding keys before verifying the user's configuration permissions, allowing an attacker to exhaust system memory and crash the service."], "name": "CVE-2026-67408", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Will not fix", "package_name": "rabbitmq-server4.2", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "rabbitmq-server4.3", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Out of support scope", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Out of support scope", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Out of support scope", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Fix deferred", "package_name": "rabbitmq-server", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-09-25T16:35:22Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-67408\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-67408\nhttps://github.com/rabbitmq/rabbitmq-server/commit/0f3defd176e027f54f447beee168d906d4f109b6\nhttps://github.com/rabbitmq/rabbitmq-server/commit/eb11bc44005fd6d327a78bf171bc598207778c9b\nhttps://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.9\nhttps://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.3\nhttps://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-2hm4-4438-49q8"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.3.0,4.3.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.2.0,4.2.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.1.0,4.1.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "rabbitmq-server", "source": "cna", "vendor": "rabbitmq"}, "product": "rabbitmq-server", "vendor": "rabbitmq"}], "created": "2026-09-25T18:00:20.827291+00:00", "updated": "2026-10-03T02:00:22.343083+00:00", "vendors": ["rabbitmq", "rabbitmq$PRODUCT$rabbitmq-server"]}