Inefficient regular expression complexity in RabbitMQ Server - #VU137257
Published: July 9, 2026
Vulnerability identifier: #VU137257
CSH Severity: Low
CVSS v4 BT: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to inefficient regular expression complexity in the management API list endpoints when processing a user-supplied ?name= regular expression with use_regex=true. A remote user can send a specially crafted request to cause a denial of service.
Exploitation requires a user account with the management tag. The regular expression is evaluated once per resource in the result set, which can lead to prolonged CPU consumption and scheduler saturation on large result sets.
Affected software
RabbitMQ Server
Remediation
Install security update from vendor's website.
RabbitMQ Server - addressed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6