CVE-2026-67408 rabbitmq CVE debrief

Who should care

RabbitMQ administrators and users with low-privileged management access should assess their exposure and prioritize patching to prevent potential denial-of-service attacks. Defenders should prioritize patching RabbitMQ instances, especially those with low-privileged management users, to prevent potential denial-of-service attacks. The vulnerability allows an authenticated low-privileged management user to cause large transient allocations before the

Why it matters

Defenders should prioritize patching RabbitMQ instances, especially those with low-privileged management users, to prevent potential denial-of-service attacks. The vulnerability allows an authenticated low-privileged management user to cause large transient allocations before the resource permission check, potentially leading to a denial-of-service in memory-limited RabbitMQ nodes. The impact requires verification from official sources, and evidence is limited to CVE and NVD records.

• Denial-of-service in memory-limited RabbitMQ nodes
• Potential for large transient allocations before resource permission checks
• Need for patching to prevent exploitation

Technical summary

The vulnerability exists in the Stream Management Super-Stream Binding Keys Allocation feature of RabbitMQ. An authenticated low-privileged management user with access to the target vhost can send a specially crafted HTTP PUT request to the /api/stream/super-streams/{vhost}/{name} endpoint, causing large transient allocations before the resource permission check. This can lead to a denial-of-service in memory-limited RabbitMQ nodes.

Defensive priority

Defenders should prioritize patching RabbitMQ instances, especially those with low-privileged management users, to prevent potential denial-of-service attacks.

Recommended defensive actions

• Patch RabbitMQ instances to versions 4.3.3, 4.2.9, or 4.1.11
• Restrict access to the /api/stream/super-streams/{vhost}/{name} endpoint for low-privileged management users
• Monitor RabbitMQ instances for unusual activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including affected versions and fixed versions (4.3.3, 4.2.9, and 4.1.11). Evidence is limited to CVE and NVD records. Official sources indicate that an authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP PUT request. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container. The impact requires verification from official sources, and evidence is limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.