High severity7.5NVD Advisory· Published Jul 10, 2026· Updated Oct 9, 2026
CVE-2026-57220
CVE-2026-57220
Description
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remote client to declare oversized frame lengths and consume broker memory in rabbit_stream_core. This issue is fixed in version 4.2.6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- Range: <4.2.6
Patches
Vulnerability mechanics
References
6- github.com/rabbitmq/rabbitmq-server/commit/595ec28fa1621b1f2c28124e4e0466a8ad963547nvdPatch
- github.com/rabbitmq/rabbitmq-server/commit/773a49c4921e8be990262a2d609c35916825679envdPatch
- github.com/rabbitmq/rabbitmq-server/pull/16171nvdIssue TrackingPatch
- github.com/rabbitmq/rabbitmq-server/pull/16173nvdIssue TrackingPatch
- github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-f364-87q5-j35qnvdExploitVendor Advisory
- github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6nvdRelease Notes
News mentions
1- RabbitMQ: Nine Vulnerabilities Disclosed Together, Threatening Authentication and Data IntegrityVypr Intelligence · Jul 18, 2026