PT-2026-57305 · Rabbitmq · Rabbitmq-Server

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-57220

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remote client to declare oversized frame lengths and consume broker memory in rabbit stream core. This issue is fixed in version 4.2.6.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-57220

Affected Products

Rabbitmq-Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-57220 · Security Note
• https://github.com/rabbitmq/rabbitmq-server/pull/16173 · Note
• https://github.com/rabbitmq/rabbitmq-server/pull/16171 · Note
• https://github.com/rabbitmq/rabbitmq-server/commit/773a49c4921e8be990262a2d609c35916825679e · Note
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f364-87q5-j35q · Note
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 · Note
• https://github.com/rabbitmq/rabbitmq-server/commit/595ec28fa1621b1f2c28124e4e0466a8ad963547 · Note