CVE-2026-67419
Last modified
CVE-2026-67419 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. The matcher materializes duplicate destinations before deduplication, causing combinatorial CPU work and memory pressure that can disrupt routing for all tenants. This vulnerability is fixed in 4.3.5.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Broadcom | Rabbitmq Server | >= 4.3.0, < 4.3.5 |
References
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h964-v5mf-22cqVendor Advisory, Exploit, Mitigation
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-h964-v5mf-22cqVendor Advisory, Exploit, Mitigation
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-67419?
How severe is CVE-2026-67419?
How do I fix CVE-2026-67419?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-67412RabbitMQ is a messaging and streaming broker. From 3.13.0 un…7.1
- CVE-2026-67413RabbitMQ is a messaging and streaming broker. From 4.0.0 unt…6.5
- CVE-2026-67414RabbitMQ is a messaging and streaming broker. From 4.0.0 unt…6
- CVE-2026-67415RabbitMQ is a messaging and streaming broker. From 4.2.0 unt…4.9
- CVE-2026-67416RabbitMQ is a messaging and streaming broker. From 4.0.0 unt…5.3
- CVE-2026-67418RabbitMQ is a messaging and streaming broker. From 3.13.0 un…5.3
- CVE-2026-6742The Advanced iFrame plugin for WordPress is vulnerable to St…6.4
- CVE-2026-67420RabbitMQ is a messaging and streaming broker. From 3.13.0 un…6.5
- CVE-2026-67421RabbitMQ is a messaging and streaming broker. From 3.13.0 un…6.8
- CVE-2026-67422pymdown-extensions is a collection of extensions for the Pyt…7.5
- CVE-2026-67424Flyto2 Core is an execution kernel for automation and AI-age…8.5
- CVE-2026-67425Flyto2 Core is an execution kernel for automation and AI-age…8.6
Are you affected by CVE-2026-67419?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST