Executive brief
RabbitMQ is a widely used messaging system that allows different software applications to communicate with each other. A vulnerability in its stream listener component allows an unauthenticated attacker to send specially crafted data that consumes excessive server memory. This can lead to a denial-of-service condition, causing the messaging service to crash or become unresponsive, which disrupts business operations and data flow between applications.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in RabbitMQ's stream listener. The component fails to enforce configured stream frame-size limits while assembling frames during the initial authentication and before 'Tune' negotiation. An unauthenticated remote attacker can exploit this by declaring oversized frame lengths, leading to excessive memory consumption in the 'rabbit_stream_core' process. The fix, introduced in version 4.2.6, implements a defense-in-depth mechanism that enforces a strict 'max_heap_size' (defaulting to 16 MiB) on all connection processes during the handshake and authentication phase across multiple protocols (AMQP, MQTT, STOMP, Stream). If a process exceeds this limit before authenticating, the Erlang VM terminates it to protect the node.
Affected products
- RabbitMQ RabbitMQ Server >= 4.2.0, < 4.2.6
Timeline
- 2026-04-16: patched: Fixes merged into main and v4.2.x branches
- 2026-04-23: advisory: RabbitMQ 4.2.6 released
- 2026-07-10: disclosed: CVE-2026-57220 published
References
- https://github.com/rabbitmq/rabbitmq-server/commit/595ec28fa1621b1f2c28124e4e0466a8ad963547
- https://github.com/rabbitmq/rabbitmq-server/commit/773a49c4921e8be990262a2d609c35916825679e
- https://github.com/rabbitmq/rabbitmq-server/pull/16171
- https://github.com/rabbitmq/rabbitmq-server/pull/16173
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f364-87q5-j35q