CVE-2026-67228

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 does not validate the Origin header on WebSocket upgrade in the Web-MQTT and Web-STOMP handlers. With ssl_cert_login=true, the browser automatically presents the client certificate, so attacker JavaScript in the victim's browser can authenticate as the victim.

RabbitMQ before versions 4.2.7 and 4.3.1 does not enforce an explicit match limit when compiling LIKE patterns into regular expressions, allowing an authenticated AMQP 1.0 consumer with read and write permissions on a stream queue to cause significant CPU consumption via a crafted LIKE filter. Each delivered message can cause about 100-200 ms of CPU load, amplified across thousands of messages and parallel sessions. The issue is fixed in versions 4.2.7 and 4.3.1.

RabbitMQ prior to versions 4.3.0, 4.2.6, 4.1.11, 4.0.20, and 3.13.15 stores the content-header BodySize (a uint64) without validation against max_message_size. A client can declare body_size = 2^63-1 and stream fragments so the size check never fires, causing the reader process to accumulate unbounded memory. This leads to node memory exhaustion or a memory alarm, degrading all publishers cluster-wide.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 enables permessage-deflate WebSocket compression (RFC 7692) without a max_frame_size limit and without an output-size limit on decompression. An unauthenticated attacker can send a highly compressed WebSocket frame (a zlib bomb) that inflates to gigabytes in memory, crashing a RabbitMQ node running the Web-MQTT plugin.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 calls rabbit_data_coercion:atomize_keys/1 (the unsafe binary_to_atom variant) on the vhost metadata map. An administrator importing a crafted definitions file can exhaust the atom table and crash the node in a single request.

In RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, the trace consumer constructs the output path without a safe relative path check, even though the read side performs such a check. An administrator can use the name parameter to write a .log-suffixed file to an arbitrary filesystem path writable by the rabbitmq user, e.g. /etc/cron.d/x.log.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0: the AMQP 0-9-1 shovel removes credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and rabbitmqctl shovel_status.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0: when a binding is created on an x-jms-topic exchange, add_binding/3 reads the rjms_erlang_selector argument and passes it through erl_scan:string/1 and erl_parse:parse_term/1. erl_scan:string/1 interns every atom literal, validate_binding/2 is a no-op with no length cap. An authenticated low-privilege AMQP user can crash the entire broker node in fewer than 100 bind calls.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0: add_binding/3 parses the routing key as an integer weight N and computes ring positions with lists:seq(NextN0, NextN0 + N - 1). validate_binding/2 only checks N >= 1 with no upper bound. A user with write permission on a consistent-hash exchange can create a binding with a huge weight, allocating hundreds of megabytes on every cluster node.

In RabbitMQ prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, the HTTP handler accept_content/2 calls create_super_stream without the required configure permission check on the exchange and partition queues that is present in the stream-protocol path. A user with the management tag and vhost access but no configure permission can create super-streams via the HTTP API.