CVE-2026-57220 Denial of service in rabbitmq-server

What is CVE-2026-57220?

CVE-2026-57220 is a high-severity denial of service vulnerability in Broadcom Rabbitmq Server, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remote client to declare oversized frame lengths and consume broker memory in rabbit_stream_core. This issue is fixed in version 4.2.6.

Weakness: CWE-770

Which versions are affected by CVE-2026-57220?

It affects 1 product.

Products include Broadcom Rabbitmq Server.

How do I fix CVE-2026-57220?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-57220 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57220 exists.

Other vulnerabilities in Broadcom Rabbitmq Server

• CVE-2016-9877 Auth bypass in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7 Critical 9.8
• CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch Critical 9.2
• CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only Critical 9.1
• CVE-2026-57219 Information disclosure in rabbitmq-server High 8.7
• CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login High 8.2

All Broadcom Rabbitmq Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-92337, GHSA-f364-87q5-j35q, UBUNTU-CVE-2026-57220.