CVE-2026-67419

Description

An authenticated user who can bind a queue to a topic exchange and publish to that exchange can force the routing engine into combinatorial recursion by using a binding key that contains **consecutive `#` segments**. When such a binding is matched against a routing key of comparable depth, the matcher repeatedly re-enters identical `{trie node, remaining routing-key suffix}` states without memoization, and builds a duplicate list of destination results that is only deduplicated **after** the full traversal completes. A binding and routing key only tens of bytes long can therefore drive millions to billions of recursive matcher invocations and allocate a correspondingly large intermediate result list, all while producing exactly **one** queue delivery. The work is performed inline in the routing path with no connection, channel, queue, message-size, or memory-alarm limit interrupting a single in-progress traversal.

CVSS Base Scores

Affected Products

References

• https://www.cve.org/CVERecord?id=CVE-2026-67419