CVE-2026-67230 rabbitmq CVE debrief

Who should care

RabbitMQ administrators, security teams, and developers using RabbitMQ with the rabbitmq_web_stomp plugin enabled should assess exposure and apply patches or mitigations as necessary.

Why it matters

CVE-2026-67230 is a vulnerability in RabbitMQ that allows an unauthenticated client to accumulate unbounded pre-authentication state. Defenders should prioritize verifying exposure, applying patches, and monitoring RabbitMQ instances.

• Potential for denial-of-service (DoS) attacks through connection exhaustion.
• Possible impact on RabbitMQ performance and resource utilization.
• Need for verification of RabbitMQ version and plugin configuration.
• Potential for exploitation requires further investigation.

Technical summary

The rabbitmq_web_stomp plugin in RabbitMQ allows an unauthenticated client to maintain a connection with a slow stream of small frames, accumulating unbounded pre-authentication state. This issue is fixed in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. Defenders should prioritize verifying exposure of RabbitMQ instances, especially those with the rabbitmq_web_stomp plugin enabled, and apply patches or mitigations as necessary. The vulnerability affects RabbitMQ versions 3.13.0 through 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Defensive priority

Defenders should prioritize verifying exposure of RabbitMQ instances, especially those with the rabbitmq_web_stomp plugin enabled, and apply patches or mitigations as necessary.

Recommended defensive actions

• Verify if RabbitMQ instances with the rabbitmq_web_stomp plugin enabled are exposed to the internet or untrusted networks.
• Check if RabbitMQ versions are within the affected ranges (3.13.0-3.13.15, 4.0.20, 4.1.11, 4.2.6) and apply patches or mitigations as necessary.
• Monitor RabbitMQ logs for unusual connection attempts or slow frame streams.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. However, additional information on exploitation or impact is limited. Defenders should verify exposure of RabbitMQ instances, especially those with the rabbitmq_web_stomp plugin enabled, and review connection logs for unusual patterns. The rabbitmq_web_stomp plugin must be enabled for exploitation, and no authentication is required to reach the vulnerable path.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.