CVE-2026-66080: RabbitMQ: Super-stream partitions unbounded allocation
RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validatepartitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq(0, 500000000) allocates roughly 8GB. Preconditions include The rabbitmqstreammanagement plugin must be enabled. The caller needs the management tag and access to the target vhost.. This issue is fixed in versions 4.1.11, 4.2.6, and 4.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.1.11 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
Who can trigger the excessive allocation?
The caller must have the management tag and access to the target virtual host. The rabbitmq_stream_management plugin must also be enabled.
Are default RabbitMQ deployments affected?
Only deployments with the rabbitmq_stream_management plugin enabled are exposed through this issue. Exploitation additionally requires a caller with the management tag and target-vhost access.
What should be done if immediate patching is not possible?
Disable the rabbitmq_stream_management plugin if it is not required, and restrict management-tag assignments and access to affected virtual hosts. This reduces the set of callers able to submit an oversized partition count.
Which releases contain the fix?
The issue is fixed in RabbitMQ 4.1.11, 4.2.6, and 4.3.0.