RabbitMQ Server: Three Protocol Parsing Flaws Disclosed Together
Three medium-severity vulnerabilities in RabbitMQ Server's protocol parsers were disclosed on October 14, 2026, affecting MQTT 5 and AMQP 1.0 implementations.
Key findings
- Three medium-severity vulnerabilities in RabbitMQ Server disclosed on October 14, 2026.
- Vulnerabilities stem from improper handling of MQTT 5 and AMQP 1.0 protocol data parsing.
- CVE-2026-67418 affects MQTT 5 parser's handling of Request-Problem-Information on PUBLISH packets.
- CVE-2026-67416 and CVE-2026-67414 relate to flaws in the AMQP 1.0 parser's symbol length and array handling.
- Patched versions include 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
On October 14, 2026, three medium-severity vulnerabilities were disclosed in RabbitMQ Server, a popular messaging and streaming broker. These vulnerabilities, all patched on the same day, affect various versions of the server and stem from issues in how the broker handles specific network protocols and data parsing. The disclosures highlight potential weaknesses in the implementation of MQTT 5 and AMQP 1.0 protocols within RabbitMQ.
Two of the vulnerabilities, CVE-2026-67416 and CVE-2026-67414, are related to the AMQP 1.0 server-mode parser. CVE-2026-67416 involves the parser matching textual prefixes of symbolic data, sequence, and value body descriptors without correctly verifying their encoded symbol length. This could lead to improper handling of AMQP 1.0 messages. CVE-2026-67414 addresses an issue where the AMQP 1.0 binary parser materializes each element of arrays with a zero-width shared constructor, while only limiting the number of elements and not the aggregate size of arrays. This could potentially allow for the processing of oversized or malformed array data. Both of these issues affect RabbitMQ versions from 4.0.0 up to 4.0.24, 4.1.15, 4.2.10, and 4.3.4.
The third vulnerability, CVE-2026-67418, specifically targets the MQTT 5 parser. It was found that the parser incorrectly accepts the Request-Problem-Information property on PUBLISH packets, even though this property is only valid for CONNECT packets. This flaw could be exploited by an authenticated publisher to potentially disrupt or manipulate message delivery. This vulnerability affects RabbitMQ versions from 3.13.0 up to 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.
All three vulnerabilities were addressed by RabbitMQ in the following versions: 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5. Users of RabbitMQ Server are strongly advised to update to these patched versions to mitigate the risks associated with these protocol parsing flaws. The coordinated disclosure of these medium-severity issues on a single day suggests a focused effort to address specific parsing weaknesses within the broker's network protocol implementations.
Staying updated with the latest patched versions is crucial for maintaining the security and integrity of messaging systems. These vulnerabilities, while medium in severity, could be chained or exploited in specific scenarios to impact message processing and broker stability.