SB20261111215 - openEuler 24.03 LTS SP4 update for rabbitmq-server
Published: November 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2026-66073)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the management API node field handling in get_node/1 when processing crafted PUT requests to queue, exchange, or binding management endpoints. A remote user can send many requests with unique node values to cause a denial of service.
Exploitation requires a user account with the management tag and access to at least one vhost.
2) Resource exhaustion (CVE-ID: CVE-2026-67220)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in rabbit_jms_topic_exchange.erl add_binding/3 when processing the rjms_erlang_selector binding argument on an x-jms-topic exchange. A remote user can send a specially crafted queue.bind request with arbitrary selector strings to cause a denial of service.
The rabbitmq_jms_topic_exchange plugin must be enabled, and exploitation can affect the entire broker node across tenants.
3) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-67230)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the WebSocket path in the Web-STOMP handler when processing pre-authentication STOMP frames over WebSocket connections. A remote attacker can send a slow trickle of single-byte frames to cause a denial of service.
The rabbitmq_web_stomp plugin must be enabled.
4) Missing Authorization (CVE-ID: CVE-2026-67233)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to delete or restart dynamic shovels.
The vulnerability exists due to improper access control in the shovel management resource when handling DELETE requests to the shovels API endpoint. A remote user can send a crafted DELETE request to delete or restart dynamic shovels.
Only instances with the rabbitmq_shovel and rabbitmq_shovel_management plugins enabled are vulnerable.
5) Resource exhaustion (CVE-ID: CVE-2026-67415)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a persistent broker-wide denial of service.
The vulnerability exists due to uncontrolled resource consumption in the Shovel runtime parameter parser when handling management API requests that set Shovel runtime parameters. A remote privileged user can submit crafted Shovel parameter values with many unique atom-producing fields to cause a persistent broker-wide denial of service.
Only instances with the rabbitmq_shovel and rabbitmq_shovel_management plugins enabled are vulnerable. Stored malicious Shovel parameters can be reparsed after a broker restart, recreating atom pressure without another live request.
6) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-67419)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in the topic exchange routing matcher when processing binding keys with consecutive `#` wildcard segments and comparable-depth routing keys. A remote user can declare a queue binding with adjacent `#` segments and publish a matching routing key to cause a denial of service.
The issue can allocate a large intermediate duplicate destination list before deduplication, and user interaction is not required.
Remediation
Install update from vendor's website.