CVE-2026-67230: RabbitMQ: Web-STOMP unbounded pre-auth accumulation
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither maxframesize nor logintimeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frames and accumulate unbounded pre-authentication state. The rabbitmqwebstomp plugin must be enabled, and no authentication is required to reach the vulnerable path. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 3.13.15 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.0.20 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.1.11 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running RabbitMQ versions from 3.13.0 up to the fixed releases are exposed only when the rabbitmq_web_stomp plugin is enabled. The affected Web-STOMP WebSocket handler can be reached before authentication.
Does an attacker need valid RabbitMQ credentials?
No. Authentication is not required to reach the vulnerable path, so an unauthenticated client can exploit it.
What does exploitation require?
An attacker needs to maintain a WebSocket connection and send a slow stream of small frames. Before authentication, the handler did not enforce max_frame_size or login_timeout, allowing unbounded pre-authentication state to accumulate.
Which versions contain the fix?
The issue is fixed in RabbitMQ 3.13.15, 4.0.20, 4.1.11, and 4.2.6.