Is CVE-2026-66079 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-66079 being exploited in the wild.

How severe is CVE-2026-66079?

Informational severity, published 23 September 2026.

Which products and versions are affected?

Broadcom RabbitMQ 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6.

Is there a fix for CVE-2026-66079?

A patch was published on 2026-04-23: Patches released in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-66079 attacked?

It is attacked over the network.

Am I affected by CVE-2026-66079?

Check whether you run Broadcom RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-66079: RabbitMQ AMQP 1.0 array32 denial of service

CVE-2026-66079 · Severity: info · Published 2026-09-23

RabbitMQ is a message broker used to queue and route data across distributed systems. An unauthenticated attacker on the network can crash any RabbitMQ node with the default AMQP 1.0 listener enabled by sending a single malformed message frame, causing the broker to attempt to allocate over 100 GB of memory and exhausting heap space. This results in complete service loss for all applications and users relying on that node.

Technologies: Broadcom RabbitMQ. Vendors: Broadcom.

Quick answers

Is CVE-2026-66079 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-66079 being exploited in the wild.
How severe is CVE-2026-66079?: Informational severity, published 23 September 2026.
Which products and versions are affected?: Broadcom RabbitMQ 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6.
Is there a fix for CVE-2026-66079?: A patch was published on 2026-04-23: Patches released in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-66079 attacked?: It is attacked over the network.
Am I affected by CVE-2026-66079?: Check whether you run Broadcom RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The AMQP 1.0 parser in parse_array_primitive/2 for constructor 0x45 returns zero-width elements, causing the array32 parser to loop on a 32-bit Count field without consuming input. The vulnerable frame is parsed before authentication by amqp10_framing:decode_bin/1, and the default 8192-byte pre-auth frame size cap does not limit the Count field, allowing an attacker to declare ~4 billion empty list elements in a ~19-byte payload. With no max_heap_size configured on the reader process, the Erlang VM exhausts memory and terminates.

Affected products

Broadcom RabbitMQ 3.13.0 before 3.13.15; 4.0.0 before 4.0.20; 4.1.0 before 4.1.11; 4.2.0 before 4.2.6

Timeline

2026-07-09: disclosed
2026-04-23: patched: Patches released in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.