CVE-2026-66074: RabbitMQ: ReDoS via management API ?name= filter
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, matchvalue/3 passes the user-supplied ?name= regular expression to re:run with no matchlimit option, and executes it once per resource in the result set. OTP's default 10M matchlimit caps each call at roughly 100-200ms, but the regex runs once per resource in the result set. With a large set, for example 5000 queues at 150ms each, a single request consumes 12 or more minutes of CPU. Parallel requests saturate the schedulers. The useregex=true option is a supported feature on list endpoints, so this path is reachable through normal API use. Preconditions include Any user with the management tag can exploit this.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 3.13.15 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.0.20 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.1.11 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with the RabbitMQ management tag can exploit it through management API list endpoints that support the use_regex=true option. Exploitation does not require an unsupported or unusual API path.
What conditions make the impact more severe?
Impact increases with the number of resources returned by the endpoint because the supplied regular expression is evaluated once per resource. A large result set, such as thousands of queues, can cause a single request to consume many minutes of CPU, while parallel requests can saturate schedulers.
Which RabbitMQ versions contain the fix?
The issue is fixed in RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. Versions prior to those releases are affected.