# CVE-2026-67240: RabbitMQ regex backtracking CPU amplification in stream queue filters

Source: https://junglewise.ai/threats/cve-2026-67240-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-versions-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-67240 · Severity: info · Published 2026-09-23

RabbitMQ is a message broker used to handle asynchronous communication between applications. An authenticated user can craft specially designed message filters on stream queues to cause excessive CPU usage through regex pattern backtracking. By publishing messages with long property values and applying a malicious filter pattern, an attacker can consume significant CPU resources—potentially across multiple sessions—degrading broker performance and availability for legitimate users.

Technologies: [RabbitMQ](https://junglewise.ai/threats/technologies/rabbitmq-rabbitmq). Vendors: [RabbitMQ](https://junglewise.ai/threats/vendors/rabbitmq).

## Quick answers

**Is CVE-2026-67240 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67240 being exploited in the wild.

**How severe is CVE-2026-67240?** Informational severity, published 23 September 2026.

**Which products and versions are affected?** RabbitMQ Prior to 4.2.7 and 4.3.1.

**Is there a fix for CVE-2026-67240?** A patch was published on 2026-05-19: Fixed in RabbitMQ 4.2.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67240 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-67240?** Check whether you run RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in RabbitMQ's pattern_to_regex function which converts SQL LIKE patterns (% and _) into Erlang regex patterns with overlapping lazy quantifiers. A crafted LIKE string with repeated %_ pairs generates a regex with exponential backtracking behavior (e.g., ^.*?..*?.....*?.X$). When re:run is called per-message without explicit match_limit restrictions, the default 10M match_limit caps processing at ~100-200 ms per message. An authenticated AMQP 1.0 consumer with read+write permissions on a stream queue can multiply this CPU cost across thousands of messages and parallel sessions, causing substantial CPU amplification.

## Affected products

- RabbitMQ RabbitMQ Prior to 4.2.7 and 4.3.1

## Timeline

- 2026-09-23: disclosed
- 2026-05-19: patched: Fixed in RabbitMQ 4.2.7
- 2026-05-20: patched: Fixed in RabbitMQ 4.3.1

## References

- [https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7](https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7)
- [https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1](https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1)

## Related threats

- [RabbitMQ OAuth privilege escalation via stale token tags](https://junglewise.ai/threats/cve-2026-67420-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3)
- [RabbitMQ topic exchange denial of service via duplicate matchers](https://junglewise.ai/threats/cve-2026-67419-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-4-3-5-an)
- [RabbitMQ Shovel denial of service via atom exhaustion](https://junglewise.ai/threats/cve-2026-67415-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-2)
- [RabbitMQ MQTT loopback user bypass via PROXY Protocol](https://junglewise.ai/threats/cve-2026-67411-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3)
- [RabbitMQ OAuth2 client secret exposure via unauthenticated endpoint](https://junglewise.ai/threats/cve-2026-67410-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-3)