Allocation of Resources Without Limits or Throttling in RabbitMQ Server - #VU143930
Published: August 18, 2026
Vulnerability identifier: #VU143930
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the STOMP frame size handling in rabbit_stomp_reader.erl when processing unauthenticated STOMP connections. A remote attacker can send oversized STOMP frames over many concurrent unauthenticated connections to cause a denial of service.
The intended 64 KB frame limit for unauthenticated connections is defined but not enforced, and the risk increases with many concurrent unauthenticated connections.
Affected software
RabbitMQ Server
Remediation
Install security update from vendor's website.
RabbitMQ Server - addressed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, 4.3.5