SB2026110334 - Fedora 44 update for rabbitmq-server
Published: November 3, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-67414)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the AMQP 1.0 type parser when parsing a crafted AMQP 1.0 frame containing many zero-width arrays. A remote user can send a specially crafted frame after completing a SASL handshake to cause a denial of service.
The issue is triggered in the connection reader before validation or authorization of the parsed frame body, and user interaction is not required.
2) Input validation error (CVE-ID: CVE-2026-67416)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service in consumer sessions or channels.
The vulnerability exists due to improper input validation in the optimized AMQP 1.0 server_mode parser and cross-protocol conversion paths when processing AMQP 1.0 messages with symbolic body descriptors that match a fixed textual prefix but use a different encoded symbol length. A remote user can publish a specially crafted AMQP 1.0 message to cause a denial of service in consumer sessions or channels.
Exploitation requires the ability to authenticate over AMQP 1.0, write to a target exchange or queue, and have the stored message consumed through a strict AMQP 1.0 decoder or a protocol path that forces full AMQP body decoding.
3) Input validation error (CVE-ID: CVE-2026-67418)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input validation in the MQTT 5 property parser and outbound PUBLISH property serializer when processing a crafted MQTT 5 PUBLISH packet containing an inapplicable property. A remote user can send a specially crafted PUBLISH message to cause a denial of service.
MQTT or Web MQTT must be enabled, and exploitation requires a separately authenticated MQTT 5 or Web MQTT subscriber on a matching topic or subscription filter.
4) Improper access control (CVE-ID: CVE-2026-67420)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to publish messages with a foreign AMQP user_id after that privilege should have been revoked.
The vulnerability exists due to improper access control in rabbit_access_control:update_state/2 and rabbit_access_control:check_user_id/2 when refreshing an existing AMQP connection from an OAuth token that no longer grants the impersonator tag. A remote user can refresh the connection with a same-username token that omits the impersonator tag to publish messages with a foreign AMQP user_id after that privilege should have been revoked.
Only connections that previously held the impersonator tag are affected. The issue requires a refresh-capable OAuth backend for AMQP, a successful credential refresh before the original credential-expiry timer closes the connection, and it affects both existing and newly opened channels on the refreshed connection.
5) Unchecked Return Value (CVE-ID: CVE-2026-67409)
CWE-ID: CWE-252 - Unchecked Return Value
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to unchecked return value in the JWKS key fetching mechanism in uaa_jwt.erl when processing JWKS endpoint responses during signing key refresh. A remote attacker can send a crafted JWT with an unknown kid value to cause a denial of service.
Exploitation requires RabbitMQ to be configured with OAuth2 authentication using JWKS-based key discovery, and the JWKS endpoint must return an error response with a valid JSON body that lacks a keys field.
6) Information disclosure (CVE-ID: CVE-2026-67410)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in the unauthenticated /js/oidc-oauth/bootstrap.js endpoint when serving JavaScript bootstrap content for the management UI. A remote attacker can send a crafted request to retrieve the OAuth2 client secret and disclose sensitive information.
Only deployments with the management UI enabled, OAuth2 authentication enabled, and a configured oauth_client_secret are vulnerable.
Remediation
Install update from vendor's website.