CVE-2026-67232

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress => true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max_frame_size, so cowboy's default of infinity applies. cowlib's cow_ws:parse_payload/9 calls zlib:inflate/2 on the compressed payload with no output-size limit. An attacker can negotiate permessage-deflate during the WebSocket upgrade and send a frame containing a zlib bomb (e.g. 50 KB → 5 GB). Decompression occurs in the connection process before websocket_handle/2 ever sees the MQTT bytes. An unauthenticated attacker can crash a RabbitMQ node running the Web-MQTT plugin by sending a single highly-compressed WebSocket frame (a few KB on the wire) that inflates to gigabytes in memory. The cowboy WebSocket handler decompresses the entire frame before the MQTT CONNECT packet is processed, so no credentials are required. Preconditions include rabbitmq_web_mqtt plugin enabled (not default, but common for browser clients) Network reachability to port 15675/15676 No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

• CWE-409

• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gmgx-hhg5-43gr

Published

Sep 23, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-67226RabbitMQ is a messaging and streaming broker. From 4.0.0 unt…6.9
• CVE-2026-67227RabbitMQ is a messaging and streaming broker. From 4.0.0 unt…5.9
• CVE-2026-67228RabbitMQ is a messaging and streaming broker. Prior to versi…6.9
• CVE-2026-67229RabbitMQ is a messaging and streaming broker. Prior to versi…6.9
• CVE-2026-67230RabbitMQ is a messaging and streaming broker. From 3.13.0 un…6.3
• CVE-2026-67231RabbitMQ is a messaging and streaming broker. Prior to versi…9.1
• CVE-2026-67233RabbitMQ is a messaging and streaming broker. Prior to versi…6
• CVE-2026-67234RabbitMQ is a messaging and streaming broker. From 4.2.0 unt…2.3
• CVE-2026-67235RabbitMQ is a messaging and streaming broker. Prior to versi…7.1
• CVE-2026-67236RabbitMQ is a messaging and streaming broker. From 4.2.0 unt…8.2
• CVE-2026-67237RabbitMQ is a messaging and streaming broker. From 4.2.0 unt…7.5
• CVE-2026-67238RabbitMQ is a messaging and streaming broker. Prior to versi…7.1