CVE-2026-67419

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67419
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67419.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67419
Aliases
  • GHSA-h964-v5mf-22cq
Downstream
Published
2026-09-25T16:41:08Z
Modified
2026-09-26T03:47:11Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
RabbitMQ: Consecutive topic wildcards cause combinatorial routing work
Details

RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. The matcher materializes duplicate destinations before deduplication, causing combinatorial CPU work and memory pressure that can disrupt routing for all tenants. This vulnerability is fixed in 4.3.5.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1333",
        "CWE-407"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67419.json"
}
References

Affected packages

Git / github.com/rabbitmq/rabbitmq-server

Affected ranges

Type
GIT
Repo
https://github.com/rabbitmq/rabbitmq-server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0dde27bfdd1984ff7e157226fd97656854a7f359
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "4.3.5"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

Other
rabbitmq_v1_4_0
rabbitmq_v1_5_0
rabbitmq_v1_6_0
rabbitmq_v1_7_0
rabbitmq_v1_7_2
rabbitmq_v1_8_1
rabbitmq_v2_4_0
rabbitmq_v2_7_1
rabbitmq_v2_8_0
rabbitmq_v3_0_0
rabbitmq_v3_0_1
rabbitmq_v3_0_2
rabbitmq_v3_0_3
rabbitmq_v3_0_4
rabbitmq_v3_1_1
rabbitmq_v3_1_2
rabbitmq_v3_1_3
rabbitmq_v3_1_4
rabbitmq_v3_1_5
rabbitmq_v3_2_1
rabbitmq_v3_2_2
rabbitmq_v3_2_3
rabbitmq_v3_2_4
rabbitmq_v3_3_0
rabbitmq_v3_3_1
rabbitmq_v3_3_2
rabbitmq_v3_3_3
rabbitmq_v3_3_4
rabbitmq_v3_3_5
rabbitmq_v3_4_0
rabbitmq_v3_4_1
rabbitmq_v3_4_2
rabbitmq_v3_4_3
rabbitmq_v3_5_0
rabbitmq_v3_6_0
rabbitmq_v3_6_0_milestone1
rabbitmq_v3_6_0_milestone2
rabbitmq_v3_6_0_milestone3
rabbitmq_v3_6_0_rc1
rabbitmq_v3_6_0_rc2
rabbitmq_v3_6_0_rc3
rabbitmq_v3_7_0_milestone1
rabbitmq_v3_7_0_milestone10
rabbitmq_v3_7_0_milestone11
rabbitmq_v3_7_0_milestone12
rabbitmq_v3_7_0_milestone13
rabbitmq_v3_7_0_milestone14
rabbitmq_v3_7_0_milestone15
rabbitmq_v3_7_0_milestone16
rabbitmq_v3_7_0_milestone17
rabbitmq_v3_7_0_milestone18
rabbitmq_v3_7_0_milestone2
rabbitmq_v3_7_0_milestone3
rabbitmq_v3_7_0_milestone4
rabbitmq_v3_7_0_milestone5
rabbitmq_v3_7_0_milestone7
rabbitmq_v3_7_0_milestone8
rabbitmq_v3_7_0_milestone9
v3.*
v3.11.0-rc.2
v3.13.0
v3.13.0-beta.1
v3.13.0-beta.2
v3.13.0-beta.3
v3.13.0-beta.4
v3.13.0-beta.5
v3.13.0-beta.6
v3.13.0-rc.1
v3.13.0-rc.2
v3.13.0-rc.3
v3.13.0-rc.4
v3.13.0-rc.5
v3.13.0-rc.6
v3.7.0-beta.19
v3.7.0-beta.20
v3.7.0-rc.1
v3.7.0-rc.2
v3.8.0-beta.1
v3.8.0-beta.2
v3.8.0-beta.3
v3.8.0-beta.4
v3.8.0-beta.5
v3.8.0-beta.6
v3.8.0-beta.7
v3.8.0-rc.1
v3.8.10
v4.*
v4.1.0-alpha
v4.1.0-beta.1
v4.1.0-beta.2
v4.1.0-beta.3
v4.1.0-beta.4
v4.2.0-beta.1
v4.2.0-beta.2
v4.2.0-beta.3
v4.2.0-beta.4
v4.3.0
v4.3.0-beta.1
v4.3.0-rc.0
v4.3.0-rc.1
v4.3.1
v4.3.2
v4.3.3
v4.3.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67419.json"