Quick answers
- Is CVE-2026-67408 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-67408 being exploited in the wild.
- How severe is CVE-2026-67408?
- Informational severity, published 25 September 2026.
- Which products and versions are affected?
- VMware RabbitMQ 4.1.0 to 4.3.2, 4.2.0 to 4.2.8, 4.1.0 to 4.1.10 (fixed in 4.3.3, 4.2.9, 4.1.11).
- Is there a fix for CVE-2026-67408?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-67408 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-67408?
- Check whether you run VMware RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The Stream Management component's super-stream configuration endpoint (PUT /api/stream/super-streams) allocates memory for binding keys before performing permission checks, allowing an authenticated low-privilege user to trigger a denial of service. The vulnerability requires prior authentication and vhost access but does not require configure, write, or read permissions on the target stream. The fix caps the maximum number of partitions to 1000 to prevent excessive memory allocation.
Affected products
- VMware RabbitMQ 4.1.0 to 4.3.2, 4.2.0 to 4.2.8, 4.1.0 to 4.1.10 (fixed in 4.3.3, 4.2.9, 4.1.11)
Timeline
- 2026-09-25: disclosed