PT-2026-57305 · Rabbitmq · Rabbitmq-Server

Publicado 2026-07-10 · Atualizado 2026-07-10 · CVE-2026-57220

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remote client to declare oversized frame lengths and consume broker memory in rabbit stream core. This issue is fixed in version 4.2.6.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2026-57220

Produtos afetados

Rabbitmq-Server

Referências · 7

• https://github.com/rabbitmq/rabbitmq-server/pull/16173 · Nota
• https://github.com/rabbitmq/rabbitmq-server/pull/16171 · Nota
• https://github.com/rabbitmq/rabbitmq-server/commit/773a49c4921e8be990262a2d609c35916825679e · Nota
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f364-87q5-j35q · Nota
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 · Nota
• https://github.com/rabbitmq/rabbitmq-server/commit/595ec28fa1621b1f2c28124e4e0466a8ad963547 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-57220 · Nota de Segurança