CVE-2026-67418: RabbitMQ MQTT 5: inapplicable PUBLISH property disconnects matching subscribers
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmqmqtt/src/rabbitmqttpacket.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated publisher with topic write permission can cause the broker to store and route that inapplicable property to a separately authenticated matching subscriber. When the subscriber path serializes the outbound PUBLISH, serialiseprop/2 has no matching clause, and the uncontained functionclause exception closes the victim MQTT or Web MQTT connection. The publisher connection and broker remain available, and queued replay, retained-message persistence, and broker-wide denial of service were not established. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 3.13.19 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.0.24 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.1.15 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.10 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.5
Event History
Frequently Asked Questions
Who can exploit this issue, and which clients are affected?
An attacker must be an authenticated MQTT publisher with permission to write to a topic. The impact is on separately authenticated MQTT or Web MQTT subscribers whose subscriptions match the attacker-controlled PUBLISH topic.
What happens when the malformed PUBLISH reaches a subscriber?
The affected subscriber connection is closed when RabbitMQ attempts to serialize the outbound PUBLISH containing the inapplicable Request-Problem-Information property. The publisher connection and the broker itself remain available.
Is a broker-wide denial of service or message persistence impact confirmed?
No. Broker-wide denial of service, queued replay, and retained-message persistence were not established for this issue.
Which RabbitMQ releases contain the fix?
The issue is fixed in RabbitMQ 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.