Log in Start free

Vulnerability · Published Sep 23, 2026 · Assigned by GitHub_M

CVE-2026-67232RabbitMQ: Web-MQTT decompression bomb

High 8.2

In plain English

A high-severity security flaw in rabbitmq-server from rabbitmq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High
Exploit odds (30 days)0.4%top 66.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress => true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max_frame_size, so cowboy's default of infinity applies. cowlib's cow_ws:parse_payload/9 calls zlib:inflate/2 on the compressed payload with no output-size limit. An attacker can negotiate permessage-deflate during the WebSocket upgrade and send a frame containing a zlib bomb (e.g. 50 KB → 5 GB). Decompression occurs in the connection process before websocket_handle/2 ever sees the MQTT bytes. An unauthenticated attacker can crash a RabbitMQ node running the Web-MQTT plugin by sending a single highly-compressed WebSocket frame (a few KB on the wire) that inflates to gigabytes in memory. The cowboy WebSocket handler decompresses the entire frame before the MQTT CONNECT packet is processed, so no credentials are required. Preconditions include rabbitmq_web_mqtt plugin enabled (not default, but common for browser clients) Network reachability to port 15675/15676 No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rabbitmq-serverno fix listedDEBIAN-CVE-2026-67232
Debian:13rabbitmq-serverno fix listedDEBIAN-CVE-2026-67232
Debian:14rabbitmq-server4.3.0-2DEBIAN-CVE-2026-67232
Ubuntu:22.04:LTSrabbitmq-server3.9.27-0ubuntu0.6UBUNTU-CVE-2026-67232
Ubuntu:22.04:LTSrabbitmq-server3.9.27-0ubuntu0.6USN-8933-1
Ubuntu:24.04:LTSrabbitmq-server3.12.1-1ubuntu1.7USN-8933-1
Ubuntu:24.04:LTSrabbitmq-server3.12.1-1ubuntu1.7UBUNTU-CVE-2026-67232
Ubuntu:26.04:LTSrabbitmq-server4.0.5-10ubuntu5.2USN-8933-1
Ubuntu:26.04:LTSrabbitmq-server4.0.5-10ubuntu5.2UBUNTU-CVE-2026-67232

Affected products (as reported)

VendorProductVersions
rabbitmq rabbitmq-server >= 3.13.0, < 3.13.15>= 4.0.0, < 4.0.20>= 4.1.0, < 4.1.11>= 4.2.0, < 4.2.6

Weakness: CWE-409 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References