RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max_frame_size nor login_timeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frames and accumulate unbounded pre-authentication state. The rabbitmq_web_stomp plugin must be enabled, and no authentication is required to reach the vulnerable path. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Affected Vendors & Products

Vendors Products
Broadcom
  • Rabbitmq Server
Rabbitmq
  • Rabbitmq-server

Configuration 1 [-]

OR cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/rabbitmq/rabbitmq-server/commit/0b4080fa5d6f797b6331d0ce1db2b4bacd34560e cve-icon cve-icon
https://github.com/rabbitmq/rabbitmq-server/commit/8138edae6d2beaafe699a41a754d17420bdc2068 cve-icon cve-icon
https://github.com/rabbitmq/rabbitmq-server/commit/c1000ba89052608c01c052d98016403ba6e92222 cve-icon cve-icon
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 cve-icon cve-icon
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-7v63-j4gm-p4rh cve-icon cve-icon
History

Tue, 20 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Broadcom
Broadcom rabbitmq Server
CPEs cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
Vendors & Products Broadcom
Broadcom rabbitmq Server
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Tue, 29 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Sat, 26 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Rabbitmq
Rabbitmq rabbitmq-server
Vendors & Products Rabbitmq
Rabbitmq rabbitmq-server

Fri, 25 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither max_frame_size nor login_timeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frames and accumulate unbounded pre-authentication state. The rabbitmq_web_stomp plugin must be enabled, and no authentication is required to reach the vulnerable path. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Title RabbitMQ: Web-STOMP unbounded pre-auth accumulation
Weaknesses CWE-770
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-09-25T16:01:40.340Z

Updated: 2026-09-29T19:22:26.179Z

Reserved: 2026-07-28T19:50:39.437Z

Link: CVE-2026-67230

cve-icon Vulnrichment

Updated: 2026-09-29T19:22:21.479Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-25T17:17:11.600

Modified: 2026-10-20T13:32:39.940

Link: CVE-2026-67230

cve-icon Redhat

No data.