CVE-2026-67419

UNKNOWN 0.0

RabbitMQ: Consecutive topic wildcards cause combinatorial routing work

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. The matcher materializes duplicate destinations before deduplication, causing combinatorial CPU work and memory pressure that can disrupt routing for all tenants. This vulnerability is fixed in 4.3.5.

CWE	CWE-407 CWE-1333
Vendor	rabbitmq
Product	rabbitmq-server
Published	Sep 25, 2026
Last Updated	Sep 25, 2026

Stay Ahead of the Next One

Get instant alerts for rabbitmq rabbitmq-server

Be the first to know when new unknown vulnerabilities affecting rabbitmq rabbitmq-server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

rabbitmq / rabbitmq-server

< 4.3.5

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h964-v5mf-22cq github.com: https://github.com/rabbitmq/rabbitmq-server/commit/c5ed7c4e97e02be688730803604cc7a88dbe4864 github.com: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5