DEBIAN-CVE-2026-67242

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-67242
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-67242.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-67242
Upstream
Published
2026-09-25T17:17:12Z
Modified
2026-10-23T18:05:03Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isinteger(Exp) guard skips token-expiry checks for float exp. validatetokenexpiry/1 (lines 208-214) and expirytimestamp/1 (138-144) both guard with 'when isinteger(Exp)' and fall through to ok/never for float values. josejwt:verify validates only the signature, not exp. With float exp, no expiry validation occurs anywhere in the If the IdP emits exp as a JSON float (RFC 7519 permits fractional NumericDate), both the login-time expiry check and the mid-connection disconnect timer are silently skipped , an already-expired token is accepted, and connections never time OAuth2 backend enabled IdP emits float exp (uncommon; mainstream IdPs emit integers) Attacker possesses a previously-valid signed. This issue is fixed in versions 4.2.9 and 4.3.3.

References

Affected packages

Debian:14 / rabbitmq-server

Package

Name
rabbitmq-server
Purl
pkg:deb/debian/rabbitmq-server?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.3.6-1

Affected versions

4.*
4.0.5-6
4.0.5-8
4.0.5-9
4.0.5-10
4.0.5-11
4.0.5-12
4.0.5-13
4.0.5-14
4.3.0-1
4.3.0-2
4.3.0-3
4.3.2-1
4.3.2-2
4.3.2-3
4.3.2-4
4.3.2-5

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-67242.json"