CVE-2026-67416

Description

RabbitMQ is an open source multi-protocol messaging broker. The optimized AMQP 1.0 server-mode parser recognizes symbolic message body descriptors by matching a fixed textual prefix without validating the encoded symbol length, so an authenticated publisher with write permission to an exchange or queue can submit a described value whose descriptor merely begins with `amqp:data:binary`, `amqp:amqp-sequence:list`, or `amqp:amqp-value:*` (for example the well-formed but unknown descriptor `amqp:data:binary@`) and have it misclassified as a standard body section. The accepted bytes are retained unchanged through classic, quorum, and stream queues and forwarded to AMQP 1.0 consumers, whose strict decoders reject the unknown descriptor; conversion to AMQP 0-9-1 and other protocols performs a full decode on the broker side, causing an uncontrolled parser exit in the consumer protocol process. With acknowledgement-required consumers the stored poison entry can be repeatedly redelivered after reconnection, resulting in denial of service of consumer sessions or channels (the broker node itself remains alive). Fixed in RabbitMQ 4.3.4, 4.2.10, 4.1.15, and 4.0.24, which require exact symbolic descriptor lengths in the fast-path parsing clauses.

CVSS Base Scores

Affected Products

References

• https://www.cve.org/CVERecord?id=CVE-2026-67416