# CVE-2026-67418: RabbitMQ MQTT 5 parser invalid property denial of service

Source: https://junglewise.ai/threats/cve-2026-67418-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-67418 · Severity: info · Published 2026-10-14

RabbitMQ is a message broker used to route and queue data between applications. An authenticated MQTT client can send a specially crafted message with an invalid property, causing the broker to disconnect legitimate subscriber connections. While the broker remains operational and the publisher stays connected, this disrupts service for affected subscribers.

Technologies: [VMware RabbitMQ](https://junglewise.ai/threats/technologies/vmware-rabbitmq). Vendors: [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-67418 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67418 being exploited in the wild.

**How severe is CVE-2026-67418?** Informational severity, published 14 October 2026.

**Which products and versions are affected?** VMware RabbitMQ 3.13.0 to 3.12.18, 4.0.0 to 4.0.23, 4.1.0 to 4.1.14, 4.2.0 to 4.2.9, 4.3.0 to 4.3.4.

**Is there a fix for CVE-2026-67418?** Yes: fixed in RabbitMQ 3.13.19, 4.0.24, 4.1.15, 4.2.10, 4.3.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67418 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-67418?** Check whether you run VMware RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in RabbitMQ 3.13.19, 4.0.24, 4.1.15, 4.2.10, 4.3.5

## Technical details

The MQTT 5 parser in RabbitMQ fails to validate that certain packet properties are only used with valid packet types. An authenticated publisher sends a PUBLISH packet with Request-Problem-Information (valid only for CONNECT), which the broker stores and forwards to matching subscribers. When the subscriber's serializer encounters the invalid property, it triggers an unhandled function_clause exception that closes the MQTT connection. The vulnerability requires authentication and topic write permission.

## Affected products

- VMware RabbitMQ 3.13.0 to 3.12.18, 4.0.0 to 4.0.23, 4.1.0 to 4.1.14, 4.2.0 to 4.2.9, 4.3.0 to 4.3.4

## Timeline

- 2026-10-14: disclosed

## References

- [https://github.com/rabbitmq/rabbitmq-server/commit/4639a4318c72a0660e4bc014767fad70ce288fbc](https://github.com/rabbitmq/rabbitmq-server/commit/4639a4318c72a0660e4bc014767fad70ce288fbc)
- [https://github.com/rabbitmq/rabbitmq-server/commit/908f944a1d581d10774f8d6d0dcf2a1a713779fb](https://github.com/rabbitmq/rabbitmq-server/commit/908f944a1d581d10774f8d6d0dcf2a1a713779fb)

## Related threats

- [RabbitMQ AMQP 1.0 parser descriptor validation bypass](https://junglewise.ai/threats/cve-2026-67416-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0)
- [RabbitMQ AMQP 1.0 parser memory exhaustion](https://junglewise.ai/threats/cve-2026-67414-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0)
- [RabbitMQ Management XSS via queue name in OAuth UI](https://junglewise.ai/threats/cve-2026-67421-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3)
- [RabbitMQ JMS topic exchange denial of service via regex wildcard expansion](https://junglewise.ai/threats/cve-2026-67413-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0)
- [RabbitMQ Federation upstream authorization bypass](https://junglewise.ai/threats/cve-2026-67412-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-4)