CVE-2026-66080CWE-770denial-of-service

CVE-2026-66080

Medium · published September 24, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
23.3
In the wild
Unconfirmed
What it is

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validate_partitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq(0, 500000000) allocates roughly 8GB. Preconditions include The rabbitmq_stream_management plugin must be enabled. The caller needs the management tag and access to the target vhost.. This issue is fixed in versions 4.1.11, 4.2.6, and 4.3.0.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
5.9 · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00316 · 23.3th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-09-24T01:16Z
Affected products (2)
ProductVersionsFixed in
broadcom/rabbitmq_server≥ 4.1.0, < 4.1.114.1.11
broadcom/rabbitmq_server≥ 4.2.0, < 4.2.64.2.6
References (3)
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 · [email protected]https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0 · [email protected]https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-wg79-5449-m728 · [email protected]
EPSS history
Timeline
  • 25 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 23 SEP 20:20Z
    RabbitMQ: Super-stream partitions unbounded allocation
    cvelistv5