CVE-2026-67413 rabbitmq CVE debrief

Who should care

RabbitMQ administrators and users with access to the rabbitmq_jms_topic_exchange plugin should assess exposure and verify versions. Defenders should prioritize verifying RabbitMQ versions and restricting access to authenticated tenants to mitigate potential CPU consumption and scheduler performance degradation.

Why it matters

CVE-2026-67413 is a denial of service vulnerability in RabbitMQ's rabbitmq_jms_topic_exchange plugin. Defenders should verify RabbitMQ versions and restrict access to authenticated tenants to mitigate potential CPU consumption and scheduler performance degradation.

• Denial of service via CPU consumption
• Potential for scheduler performance degradation
• Need for version verification and upgrade
• Restricted access to authenticated tenants required

Technical summary

The rabbitmq_jms_topic_exchange plugin in RabbitMQ versions 4.0.0 to 4.0.22, 4.1.0 to 4.1.13, 4.2.0 to 4.2.8, and 4.3.0 to 4.3.2 contains a vulnerability. An authenticated tenant can bind and publish to consume broker scheduler CPU and deny service with pathological selectors. The plugin's x-jms-topic exchange accepted a client-controlled rjms_erlang_selector binding expression whose LIKE evaluator expanded percent and underscore wildcards into overlapping PCRE fragments. It executed those fragments with raw re:run/3 without match or recursion limits.

Defensive priority

Defenders should prioritize verifying RabbitMQ versions and restricting access to authenticated tenants

Recommended defensive actions

• Verify RabbitMQ version and upgrade to 4.0.23, 4.1.14, 4.2.9, or 4.3.3
• Restrict access to authenticated tenants
• Monitor broker scheduler CPU usage
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in RabbitMQ's rabbitmq_jms_topic_exchange plugin. The issue allows an authenticated tenant to consume broker scheduler CPU and deny service with pathological selectors. The plugin's x-jms-topic exchange accepted a client-controlled rjms_erlang_selector binding expression whose LIKE evaluator expanded percent and underscore wildcards into overlapping PCRE fragments. It executed those fragments with raw re:run/3 without match or recursion limits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.