Input validation error in RabbitMQ Server - #VU139302
Published: July 24, 2026
Vulnerability details
The vulnerability allows a remote user to cause a denial of service in consumer sessions or channels.
The vulnerability exists due to improper input validation in the optimized AMQP 1.0 server_mode parser and cross-protocol conversion paths when processing AMQP 1.0 messages with symbolic body descriptors that match a fixed textual prefix but use a different encoded symbol length. A remote user can publish a specially crafted AMQP 1.0 message to cause a denial of service in consumer sessions or channels.
Exploitation requires the ability to authenticate over AMQP 1.0, write to a target exchange or queue, and have the stored message consumed through a strict AMQP 1.0 decoder or a protocol path that forces full AMQP body decoding.