Medium severity · published Oct 14, 2026
CVE-2026-67416
RabbitMQ: AMQP 1.0 symbolic body descriptor prefix collisions bypass validation
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, the optimized AMQP 1.0 server_mode parser in deps/amqp10_common/src/amqp10_binary_parser.erl matches the textual prefixes of symbolic data, sequence, and value body descriptors without verifying their encoded symbol lengths. An authenticated AMQP 1.0 publisher with write permission can submit a well-formed unknown descriptor that begins with a registered body descriptor, and RabbitMQ misclassifies and stores the bytes as a standard body section. Strict AMQP 1.0 consumers can terminate while decoding the stored entry. For bodies misclassified as data, AMQP 0-9-1 or other cross-protocol conversion performs full body decoding and can terminate the consumer protocol process, with acknowledgement-required delivery permitting repeated failures. Sequence and value classifications are normally transported as opaque encoded payloads on that conversion path. The broker remains alive, and the issue does not bypass routing or authorization. This issue is fixed in versions 4.0.24, 4.1.15, 4.2.10, and 4.3.4.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
rabbitmq-server · rabbitmq
>= 4.0.0, < 4.0.24; >= 4.1.0, < 4.1.15; >= 4.2.0, < 4.2.10; >= 4.3.0, < 4.3.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67416
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67416
x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-p35w-6mx2-q4pc
x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/pull/17017
x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/pull/17287
x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/commit/c9b4b10c2dbf0f1c89f10b482ac8b45f84dc5954
x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/commit/d5186e66e056960f58e2d0fbee2fcc66e1ed6fb9
x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.4
More from rabbitmq-server
10.0
CVE-2026-57216
RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checks
10.0
CVE-2026-57211
RabbitMQ: UNC SSRF affecting the management UI on Windows
9.3
CVE-2026-67237
RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint
9.1
CVE-2026-67231
RabbitMQ: Trust-store whitelist by Issuer+Serial only
8.8
CVE-2026-66070
RabbitMQ: CORS * reflects Origin with Allow-Credentials
