CVE-2026-67408 RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service
A low-privileged authenticated user can cause a denial of service in RabbitMQ by triggering excessive memory allocation via stream binding keys.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-67408?
CVE-2026-67408 is a high-severity denial of service vulnerability in Broadcom Rabbitmq Server, published on 25 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11.
Weakness: CWE-400
Which versions are affected by CVE-2026-67408?
1 open source package ship an affected version, including rabbitmq. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rabbitmq Bitnami | From 4.1.0 | 4.1.11, 4.2.9, 4.3.3 |
Products include Broadcom Rabbitmq Server.
How do I fix CVE-2026-67408?
Upgrade rabbitmq to a fixed version for your release line: 4.1.11, 4.2.9 or 4.3.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-67408 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-67408 exists.
Other vulnerabilities in Broadcom Rabbitmq Server
- CVE-2016-9877 Auth bypass in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7
- CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
- CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only
- CVE-2026-57219 Information disclosure in rabbitmq-server
- CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
Sources
Also known as BIT-rabbitmq-2026-67408, DEBIAN-CVE-2026-67408, GHSA-2hm4-4438-49q8, UBUNTU-CVE-2026-67408.