CVE-2026-67419: RabbitMQ: Consecutive topic wildcards cause combinatorial routing work
RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. The matcher materializes duplicate destinations before deduplication, causing combinatorial CPU work and memory pressure that can disrupt routing for all tenants. This vulnerability is fixed in 4.3.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.5
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user must be able to bind a queue to a topic exchange and publish messages to that exchange. The resulting routing disruption can affect all tenants sharing the broker.
Are default RabbitMQ deployments affected?
The available information does not establish whether the default configuration grants the required queue-binding and publishing permissions. Exposure depends on whether an authenticated user has both permissions on a topic exchange.
What configuration pattern triggers the excessive work?
The attacker uses a binding key containing consecutive # segments, then publishes to the affected topic exchange. This causes the topic matchers to revisit routing states and create duplicate destinations before deduplication.
What should be done if an immediate upgrade is not possible?
Restrict untrusted authenticated users from creating bindings on topic exchanges and from publishing to them, especially where both permissions are available to the same user. This reduces the ability to create the malicious binding-and-publish combination.
How can I determine whether my broker version is fixed?
RabbitMQ 4.3.5 contains the fix. Versions prior to 4.3.5 are affected according to the available information.