CVE-2026-67418

Description

RabbitMQ's MQTT 5 property parser accepts properties without checking whether they are valid for the enclosing packet type. An authenticated publisher can include `Request-Problem-Information` (MQTT property 0x17) in a `PUBLISH` — a property that the MQTT 5 specification restricts to `CONNECT` — and the broker will store and route it. When a matching subscriber's reader later serializes the outbound `PUBLISH`, `serialise_prop/2` has **no clause** for `Request-Problem-Information`, raising `error:function_clause`. That exception is not contained at the victim queue-event boundary, so the **victim's entire MQTT connection** is closed. The publisher's connection and the broker remain healthy.

CVSS Base Scores

Affected Products

References

• https://www.cve.org/CVERecord?id=CVE-2026-67418