CVE-2026-67419
This vulnerability is fixed in 4.3.5.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.37%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. The matcher materializes duplicate destinations before deduplication, causing combinatorial CPU work and memory pressure that can disrupt routing for all tenants. This vulnerability is fixed in 4.3.5.
- CVSS 4.0
- 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.37% probability · 31th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-407, CWE-1333
- Affected
- broadcom/rabbitmq server
- Source
- security-advisories@github.com
EPSS moved from 0.3% on 26 September 2026 to 0.4% on 26 October 2026.
References
- https://github.com/rabbitmq/rabbitmq-server/commit/c5ed7c4e97e02be688730803604cc7a88dbe4864Patch
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5Release Notes
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h964-v5mf-22cqVendor Advisory, Exploit, Mitigation
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h964-v5mf-22cqVendor Advisory, Exploit, Mitigation
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.