{"answers":{"affected":"1 open source package ship an affected version, including rabbitmq. It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-66079 in the wild and no public exploit code.","fix":"Upgrade rabbitmq to a fixed version for your release line: 3.13.15, 4.0.20, 4.1.11 or 4.2.6.","what":"CVE-2026-66079 is a high-severity vulnerability in Broadcom Rabbitmq Server, published on 23 Sep 2026."},"fix_prompt":"Check this codebase for CVE-2026-66079 and fix it if it is affected.\n\nWhat it is: CVE-2026-66079 is a high-severity vulnerability in Broadcom Rabbitmq Server, published on 23 Sep 2026. \nExploitation: There is no known exploitation of CVE-2026-66079 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- rabbitmq (Bitnami): affected from 3.13.0; fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-66079/ (Markdown: https://insights.sbomify.com/CVE-2026-66079/index.md)","id":"CVE-2026-66079","markdown":"https://insights.sbomify.com/CVE-2026-66079/index.md","name":"CVE-2026-66079","record":{"aliases":["AZL-105744","BIT-rabbitmq-2026-66079","DEBIAN-CVE-2026-66079","GHSA-c66h-hf5j-8jf9","UBUNTU-CVE-2026-66079"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[{"product":"rabbitmq_server","vendor":"broadcom"}],"cvss":{"score":8.2,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling"}],"description":"RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.","ecosystems":["Bitnami"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS","id":"CVE-2026-66079","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":"broadcom:rabbitmq_server","products":["broadcom:rabbitmq_server"],"type":null,"year":"2026"},"n_packages":1,"n_references":2,"next":{"headline":"RabbitMQ: Super-stream partitions unbounded allocation","id":"CVE-2026-66080"},"packages":[{"ecosystem":"Bitnami","fixed":["3.13.15","4.0.20","4.1.11","4.2.6"],"introduced":["3.13.0","4.0.0","4.1.0","4.2.0"],"last_affected":[],"package":"rabbitmq","purl":"pkg:bitnami/rabbitmq","source":"BIT-rabbitmq-2026-66079"}],"prev":{"headline":"RabbitMQ: protected tag bypass via bulk-delete","id":"CVE-2026-66078"},"products":["rabbitmq-server"],"published":"2026-09-23","related":[{"cvss_score":9.8,"headline":"Auth bypass in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7","id":"CVE-2016-9877","kev_date_added":null,"published":"2016-12-29"},{"cvss_score":9.2,"headline":"RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch","id":"CVE-2026-67404","kev_date_added":null,"published":"2026-09-23"},{"cvss_score":9.1,"headline":"RabbitMQ: Trust-store whitelist by Issuer+Serial only","id":"CVE-2026-67231","kev_date_added":null,"published":"2026-09-23"},{"cvss_score":8.7,"headline":"Information disclosure in rabbitmq-server","id":"CVE-2026-57219","kev_date_added":null,"published":"2026-07-10"},{"cvss_score":8.2,"headline":"RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login","id":"CVE-2026-67236","kev_date_added":null,"published":"2026-09-25"},{"cvss_score":8.2,"headline":"RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS","id":"CVE-2026-67409","kev_date_added":null,"published":"2026-09-25"},{"cvss_score":8.2,"headline":"RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint","id":"CVE-2026-67410","kev_date_added":null,"published":"2026-09-25"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-29","vendors":["rabbitmq"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-66079/"}