CVE-2026-67419: RabbitMQ: Consecutive topic wildcards cause combinatorial routing work

Published Sep 25, 2026
·
Updated

RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. The matcher materializes duplicate destinations before deduplication, causing combinatorial CPU work and memory pressure that can disrupt routing for all tenants. This vulnerability is fixed in 4.3.5.

Affected Software

1 affected component
RabbitMQ RabbitMQ<4.3.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade RabbitMQ to a version that resolves this vulnerability.

    Fixed in 4.3.5

Event History

Sep 25, 2026
CVE Published
via MITRE·04:41 PM
Data Sourced
via MITRE·04:41 PM
DescriptionWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who can exploit this issue?

An authenticated user must be able to bind a queue to a topic exchange and publish messages to that exchange. The resulting routing disruption can affect all tenants sharing the broker.

2

Are default RabbitMQ deployments affected?

The available information does not establish whether the default configuration grants the required queue-binding and publishing permissions. Exposure depends on whether an authenticated user has both permissions on a topic exchange.

3

What configuration pattern triggers the excessive work?

The attacker uses a binding key containing consecutive # segments, then publishes to the affected topic exchange. This causes the topic matchers to revisit routing states and create duplicate destinations before deduplication.

4

What should be done if an immediate upgrade is not possible?

Restrict untrusted authenticated users from creating bindings on topic exchanges and from publishing to them, especially where both permissions are available to the same user. This reduces the ability to create the malicious binding-and-publish combination.

5

How can I determine whether my broker version is fixed?

RabbitMQ 4.3.5 contains the fix. Versions prior to 4.3.5 are affected according to the available information.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203