Vulnerability-Lookup

CVE-2026-66079 (GCVE-0-2026-66079)

Vulnerability from cvelistv5 – Published: 2026-09-23 20:01 – Updated: 2026-09-29 02:12

Title

RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS

Summary

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-29 02:12 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7926 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/rabbitmq/rabbitmq-server/secur…	x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/relea…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
rabbitmq	rabbitmq-server	Affected: >= 3.13.0, < 3.13.15 Affected: >= 4.0.0, < 4.0.20 Affected: >= 4.1.0, < 4.1.11 Affected: >= 4.2.0, < 4.2.6	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66079",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T02:12:28.546356Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-29T02:12:45.139Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "rabbitmq-server",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.13.0, \u003c 3.13.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.20"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.1.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.2.0, \u003c 4.2.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T20:01:15.295Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
        }
      ],
      "source": {
        "advisory": "GHSA-c66h-hf5j-8jf9",
        "discovery": "UNKNOWN"
      },
      "title": "RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-66079",
    "datePublished": "2026-09-23T20:01:15.295Z",
    "dateReserved": "2026-07-23T23:25:28.898Z",
    "dateUpdated": "2026-09-29T02:12:45.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-66079",
      "date": "2026-10-28",
      "epss": "0.00318",
      "percentile": "0.24653"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-18T01:43:50.000Z",
      "cve": "CVE-2026-66079",
      "id": "msrc_CVE-2026-66079",
      "initial_release_date": "2026-10-03T01:46:50.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-66079.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "rabbitmq-server",
                "vendor": "rabbitmq",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 3.13.0, \u003c 3.13.15"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 4.0.0, \u003c 4.0.20"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 4.1.0, \u003c 4.1.11"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 4.2.0, \u003c 4.2.6"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "603E40A7-6B53-47D4-A522-17B013CE7607",
                    "versionEndExcluding": "3.13.15",
                    "versionStartIncluding": "3.13.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9B5D0326-EB2B-40B8-98BD-ECE547F96DA4",
                    "versionEndExcluding": "4.0.20",
                    "versionStartIncluding": "4.0.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "01F24286-9982-4592-A370-70E55D6572D5",
                    "versionEndExcluding": "4.1.11",
                    "versionStartIncluding": "4.1.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7179C053-B8C1-4B72-83EB-456125ED1AAF",
                    "versionEndExcluding": "4.2.6",
                    "versionStartIncluding": "4.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."
          }
        ],
        "id": "CVE-2026-66079",
        "lastModified": "2026-10-19T20:36:50.350",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-66079",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-29T02:12:28.546356Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-23T20:17:13.150",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-19T21:37:59+00:00",
      "cve": "CVE-2026-66079",
      "id": "CVE-2026-66079",
      "initial_release_date": "2026-09-23T20:01:15.295000+00:00",
      "product_status:fixed": "3",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "7",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66079.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-21T00:02:18Z",
      "cve": "CVE-2026-66079",
      "id": "CVE-2026-66079",
      "initial_release_date": "2026-09-24T16:31:22Z",
      "product_status:known_affected": "119",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-66079",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-66079.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-66079",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-29T02:12:28.546356Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-29T02:12:41.102Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "rabbitmq-server",
              "vendor": "rabbitmq",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 3.13.0, \u003c 3.13.15"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 4.0.0, \u003c 4.0.20"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 4.1.0, \u003c 4.1.11"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 4.2.0, \u003c 4.2.6"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-23T20:01:15.295Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9"
            },
            {
              "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
            }
          ],
          "source": {
            "advisory": "GHSA-c66h-hf5j-8jf9",
            "discovery": "UNKNOWN"
          },
          "title": "RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-66079",
        "datePublished": "2026-09-23T20:01:15.295Z",
        "dateReserved": "2026-07-23T23:25:28.898Z",
        "dateUpdated": "2026-09-29T02:12:45.139Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-rabbitmq-2026-66079

Vulnerability from bitnami_vulndb

Published

2026-10-01 09:32

Modified

2026-10-20 09:10

Summary

RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "rabbitmq",
        "purl": "pkg:bitnami/rabbitmq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.13.0"
            },
            {
              "fixed": "3.13.15"
            },
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.20"
            },
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.1.11"
            },
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "4.2.6"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "type": "CVSS_V4"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-66079"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
  },
  "details": "RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.",
  "id": "BIT-rabbitmq-2026-66079",
  "modified": "2026-10-20T09:10:19.569Z",
  "published": "2026-10-01T09:32:58.418Z",
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66079"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS"
}

CERTFR-2026-AVI-1376

Vulnerability from certfr_avis - Published: 2026-10-23 - Updated: 2026-10-23

De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Ubuntu	Ubuntu	Ubuntu 16.04 ESM
Ubuntu	Ubuntu	Ubuntu 26.04 LTS
Ubuntu	Ubuntu	Ubuntu 20.04 ESM
Ubuntu	Ubuntu	Ubuntu 24.04 LTS
Ubuntu	Ubuntu	Ubuntu 18.04 ESM
Ubuntu	Ubuntu	Ubuntu 14.04 ESM
Ubuntu	Ubuntu	Ubuntu 22.04 LTS

References

Title

Publication Time

Tags

Bulletin de sécurité Ubuntu USN-8928-1	2026-10-14	vendor-advisory
Bulletin de sécurité Ubuntu USN-8926-1	2026-10-14	vendor-advisory
Bulletin de sécurité Ubuntu USN-8883-2	2026-10-15	vendor-advisory
Bulletin de sécurité Ubuntu USN-8929-1	2026-10-14	vendor-advisory
Bulletin de sécurité Ubuntu USN-8931-1	2026-10-14	vendor-advisory
Bulletin de sécurité Ubuntu USN-8908-2	2026-10-13	vendor-advisory
Bulletin de sécurité Ubuntu USN-8930-1	2026-10-14	vendor-advisory
Bulletin de sécurité Ubuntu USN-8933-1	2026-10-15	vendor-advisory
Bulletin de sécurité Ubuntu USN-8925-1	2026-10-14	vendor-advisory
Bulletin de sécurité Ubuntu USN-8932-1	2026-10-14	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ubuntu 16.04 ESM",
      "product": {
        "name": "Ubuntu",
        "vendor": {
          "name": "Ubuntu",
          "scada": false
        }
      }
    },
    {
      "description": "Ubuntu 26.04 LTS",
      "product": {
        "name": "Ubuntu",
        "vendor": {
          "name": "Ubuntu",
          "scada": false
        }
      }
    },
    {
      "description": "Ubuntu 20.04 ESM",
      "product": {
        "name": "Ubuntu",
        "vendor": {
          "name": "Ubuntu",
          "scada": false
        }
      }
    },
    {
      "description": "Ubuntu 24.04 LTS",
      "product": {
        "name": "Ubuntu",
        "vendor": {
          "name": "Ubuntu",
          "scada": false
        }
      }
    },
    {
      "description": "Ubuntu 18.04 ESM",
      "product": {
        "name": "Ubuntu",
        "vendor": {
          "name": "Ubuntu",
          "scada": false
        }
      }
    },
    {
      "description": "Ubuntu 14.04 ESM",
      "product": {
        "name": "Ubuntu",
        "vendor": {
          "name": "Ubuntu",
          "scada": false
        }
      }
    },
    {
      "description": "Ubuntu 22.04 LTS",
      "product": {
        "name": "Ubuntu",
        "vendor": {
          "name": "Ubuntu",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-74222",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74222"
    },
    {
      "name": "CVE-2026-13321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13321"
    },
    {
      "name": "CVE-2026-19667",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19667"
    },
    {
      "name": "CVE-2026-87863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87863"
    },
    {
      "name": "CVE-2026-11721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11721"
    },
    {
      "name": "CVE-2026-67238",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67238"
    },
    {
      "name": "CVE-2026-97687",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97687"
    },
    {
      "name": "CVE-2026-67236",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67236"
    },
    {
      "name": "CVE-2026-86414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86414"
    },
    {
      "name": "CVE-2026-10723",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10723"
    },
    {
      "name": "CVE-2026-81736",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81736"
    },
    {
      "name": "CVE-2026-106585",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106585"
    },
    {
      "name": "CVE-2026-67239",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67239"
    },
    {
      "name": "CVE-2026-73637",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73637"
    },
    {
      "name": "CVE-2026-79768",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-79768"
    },
    {
      "name": "CVE-2026-106552",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106552"
    },
    {
      "name": "CVE-2026-67237",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67237"
    },
    {
      "name": "CVE-2026-106582",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106582"
    },
    {
      "name": "CVE-2026-87864",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87864"
    },
    {
      "name": "CVE-2026-39821",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39821"
    },
    {
      "name": "CVE-2026-19033",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19033"
    },
    {
      "name": "CVE-2026-66077",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66077"
    },
    {
      "name": "CVE-2026-80274",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-80274"
    },
    {
      "name": "CVE-2026-67232",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67232"
    },
    {
      "name": "CVE-2026-63045",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63045"
    },
    {
      "name": "CVE-2026-92389",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92389"
    },
    {
      "name": "CVE-2026-106583",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106583"
    },
    {
      "name": "CVE-2026-73636",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-73636"
    },
    {
      "name": "CVE-2026-74225",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74225"
    },
    {
      "name": "CVE-2026-74220",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74220"
    },
    {
      "name": "CVE-2026-75029",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-75029"
    },
    {
      "name": "CVE-2026-106584",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106584"
    },
    {
      "name": "CVE-2026-77119",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77119"
    },
    {
      "name": "CVE-2026-92391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92391"
    },
    {
      "name": "CVE-2019-25777",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-25777"
    },
    {
      "name": "CVE-2026-19941",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19941"
    },
    {
      "name": "CVE-2025-40778",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40778"
    },
    {
      "name": "CVE-2026-67404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67404"
    },
    {
      "name": "CVE-2026-76163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76163"
    },
    {
      "name": "CVE-2026-106555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106555"
    },
    {
      "name": "CVE-2026-78301",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-78301"
    },
    {
      "name": "CVE-2026-19774",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19774"
    },
    {
      "name": "CVE-2026-67409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67409"
    },
    {
      "name": "CVE-2017-20285",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-20285"
    },
    {
      "name": "CVE-2026-63292",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63292"
    },
    {
      "name": "CVE-2026-1519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1519"
    },
    {
      "name": "CVE-2026-67231",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67231"
    },
    {
      "name": "CVE-2026-58415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-58415"
    },
    {
      "name": "CVE-2026-87862",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-87862"
    },
    {
      "name": "CVE-2026-11331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11331"
    },
    {
      "name": "CVE-2026-77692",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-77692"
    },
    {
      "name": "CVE-2026-97689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97689"
    },
    {
      "name": "CVE-2026-19662",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19662"
    },
    {
      "name": "CVE-2026-106553",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106553"
    },
    {
      "name": "CVE-2026-94266",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94266"
    },
    {
      "name": "CVE-2025-8677",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-8677"
    },
    {
      "name": "CVE-2026-92388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-92388"
    },
    {
      "name": "CVE-2026-10822",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-10822"
    },
    {
      "name": "CVE-2026-63718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63718"
    },
    {
      "name": "CVE-2026-106587",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106587"
    },
    {
      "name": "CVE-2026-66070",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66070"
    },
    {
      "name": "CVE-2026-13204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-13204"
    },
    {
      "name": "CVE-2026-63676",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63676"
    },
    {
      "name": "CVE-2026-74221",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74221"
    },
    {
      "name": "CVE-2026-67235",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-67235"
    },
    {
      "name": "CVE-2026-81563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-81563"
    },
    {
      "name": "CVE-2026-11622",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-11622"
    },
    {
      "name": "CVE-2026-19666",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19666"
    },
    {
      "name": "CVE-2026-66079",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66079"
    },
    {
      "name": "CVE-2026-63686",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63686"
    },
    {
      "name": "CVE-2026-19668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-19668"
    },
    {
      "name": "CVE-2026-97688",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97688"
    },
    {
      "name": "CVE-2026-106586",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106586"
    },
    {
      "name": "CVE-2026-86409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86409"
    },
    {
      "name": "CVE-2026-93546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93546"
    }
  ],
  "initial_release_date": "2026-10-23T00:00:00",
  "last_revision_date": "2026-10-23T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1376",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux d\u0027Ubuntu. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux d\u0027Ubuntu",
  "vendor_advisories": [
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-8928-1",
      "url": "https://ubuntu.com/security/notices/USN-8928-1"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-8926-1",
      "url": "https://ubuntu.com/security/notices/USN-8926-1"
    },
    {
      "published_at": "2026-10-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-8883-2",
      "url": "https://ubuntu.com/security/notices/USN-8883-2"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-8929-1",
      "url": "https://ubuntu.com/security/notices/USN-8929-1"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-8931-1",
      "url": "https://ubuntu.com/security/notices/USN-8931-1"
    },
    {
      "published_at": "2026-10-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-8908-2",
      "url": "https://ubuntu.com/security/notices/USN-8908-2"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-8930-1",
      "url": "https://ubuntu.com/security/notices/USN-8930-1"
    },
    {
      "published_at": "2026-10-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-8933-1",
      "url": "https://ubuntu.com/security/notices/USN-8933-1"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-8925-1",
      "url": "https://ubuntu.com/security/notices/USN-8925-1"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 Ubuntu USN-8932-1",
      "url": "https://ubuntu.com/security/notices/USN-8932-1"
    }
  ]
}

FKIE_CVE-2026-66079

Vulnerability from fkie_nvd - Published: 2026-09-23 20:17 - Updated: 2026-10-19 20:36

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6	Release Notes
	security-advisories@github.com	https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9	Vendor Advisory

Impacted products

Vendor	Product	Version
broadcom	rabbitmq_server	*
broadcom	rabbitmq_server	*
broadcom	rabbitmq_server	*
broadcom	rabbitmq_server	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "rabbitmq-server",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.13.0, \u003c 3.13.15"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.20"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.1.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.2.0, \u003c 4.2.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "603E40A7-6B53-47D4-A522-17B013CE7607",
              "versionEndExcluding": "3.13.15",
              "versionStartIncluding": "3.13.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9B5D0326-EB2B-40B8-98BD-ECE547F96DA4",
              "versionEndExcluding": "4.0.20",
              "versionStartIncluding": "4.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "01F24286-9982-4592-A370-70E55D6572D5",
              "versionEndExcluding": "4.1.11",
              "versionStartIncluding": "4.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "7179C053-B8C1-4B72-83EB-456125ED1AAF",
              "versionEndExcluding": "4.2.6",
              "versionStartIncluding": "4.2.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6."
    }
  ],
  "id": "CVE-2026-66079",
  "lastModified": "2026-10-19T20:36:50.350",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-66079",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-29T02:12:28.546356Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-23T20:17:13.150",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

MSRC_CVE-2026-66079

Vulnerability from csaf_microsoft - Published: 2026-10-03 01:46 - Updated: 2026-10-18 01:43

Summary

RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS

Scope

1 vulnerability in this advisory, including CVE-2026-66079.

CVE-2026-66079

Fixed: 1 product Known affected: 1 product

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

RHSA-2026:67552

Vulnerability from csaf_redhat - Published: 2026-09-15 13:31 - Updated: 2026-10-23 16:43

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

54 vulnerabilities in this advisory, including CVE-2026-66079.

CVE-2026-66079

A flaw was found in RabbitMQ. An unauthenticated network attacker can exploit an issue in the AMQP 1.0 listener by sending a specially crafted ~19-byte frame. This causes the system to attempt to build a list of approximately 4 billion empty elements, exhausting heap memory and terminating the Erlang Virtual Machine (VM). This results in a complete denial of service for all tenants and protocols on the affected node.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:67552

Open the full advisory

UBUNTU-CVE-2026-66079 (CVE-2026-66079)

Vulnerability from osv_ubuntu – Published: 2026-09-23 20:17 – Updated: 2026-10-22 07:54 – Source website

Details

Severity

8.2 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-66079	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-66079	REPORT
	https://github.com/rabbitmq/rabbitmq-server/secur…	REPORT
	https://github.com/rabbitmq/rabbitmq-server/relea…	REPORT
	https://ubuntu.com/security/notices/USN-8933-1	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.5.7-1ubuntu0.16.04.4+esm3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.5.7-1ubuntu0.16.04.4+esm3?arch=source\u0026distro=esm-infra-legacy/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.5.7-1ubuntu0.16.04.4+esm3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.5.4-1",
        "3.5.4-3",
        "3.5.4-3.1",
        "3.5.7-1",
        "3.5.7-1ubuntu0.16.04.1",
        "3.5.7-1ubuntu0.16.04.2",
        "3.5.7-1ubuntu0.16.04.4",
        "3.5.7-1ubuntu0.16.04.4+esm1",
        "3.5.7-1ubuntu0.16.04.4+esm2"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.6.10-1ubuntu0.5+esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.6.10-1ubuntu0.5+esm1?arch=source\u0026distro=esm-infra/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.10-1ubuntu0.5+esm1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.6.10-1",
        "3.6.10-1ubuntu0.1",
        "3.6.10-1ubuntu0.3",
        "3.6.10-1ubuntu0.4",
        "3.6.10-1ubuntu0.5"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.8.3-0ubuntu0.3+esm2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.8.3-0ubuntu0.3+esm2?arch=source\u0026distro=esm-infra/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.8.3-0ubuntu0.3+esm2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.7.8-4ubuntu2",
        "3.7.18-1",
        "3.8.2-0ubuntu1",
        "3.8.2-0ubuntu1.1",
        "3.8.2-0ubuntu1.2",
        "3.8.2-0ubuntu1.3",
        "3.8.2-0ubuntu1.4",
        "3.8.2-0ubuntu1.5",
        "3.8.3-0ubuntu0.1",
        "3.8.3-0ubuntu0.2",
        "3.8.3-0ubuntu0.3",
        "3.8.3-0ubuntu0.3+esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.9.27-0ubuntu0.6"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.9.27-0ubuntu0.6?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.27-0ubuntu0.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.8.9-3ubuntu1",
        "3.9.8-1",
        "3.9.8-2",
        "3.9.8-3",
        "3.9.8-5",
        "3.9.8-6",
        "3.9.13-1",
        "3.9.13-1ubuntu0.22.04.1",
        "3.9.13-1ubuntu0.22.04.2",
        "3.9.27-0ubuntu0.1",
        "3.9.27-0ubuntu0.2",
        "3.9.27-0ubuntu0.5"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "3.12.1-1ubuntu1.7"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@3.12.1-1ubuntu1.7?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.12.1-1ubuntu1.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.12.1-1",
        "3.12.1-1ubuntu1",
        "3.12.1-1ubuntu1.2",
        "3.12.1-1ubuntu1.4",
        "3.12.1-1ubuntu1.6"
      ]
    },
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "rabbitmq-server",
            "binary_version": "4.0.5-10ubuntu5.2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "rabbitmq-server",
        "purl": "pkg:deb/ubuntu/rabbitmq-server@4.0.5-10ubuntu5.2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.5-10ubuntu5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.5-8ubuntu2",
        "4.0.5-10ubuntu1",
        "4.0.5-10ubuntu2",
        "4.0.5-10ubuntu3",
        "4.0.5-10ubuntu4",
        "4.0.5-10ubuntu5",
        "4.0.5-10ubuntu5.1"
      ]
    }
  ],
  "aliases": [],
  "details": "RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.",
  "id": "UBUNTU-CVE-2026-66079",
  "modified": "2026-10-22T07:54:15Z",
  "published": "2026-09-23T20:17:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-66079"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66079"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-c66h-hf5j-8jf9"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6"
    },
    {
      "type": "ADVISORY",
      "url": "https://ubuntu.com/security/notices/USN-8933-1"
    }
  ],
  "related": [
    "USN-8933-1"
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-66079"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-66079 (GCVE-0-2026-66079)

bit-rabbitmq-2026-66079

Vulnerability from bitnami_vulndb

CERTFR-2026-AVI-1376

Solutions

FKIE_CVE-2026-66079

MSRC_CVE-2026-66079

RHSA-2026:67552

UBUNTU-CVE-2026-66079 (CVE-2026-66079)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour