CVE-2026-67219 Overview
CVE-2026-67219 is a resource exhaustion vulnerability [CWE-770] in RabbitMQ, an open-source messaging and streaming broker. The flaw resides in the rabbitmq_consistent_hash_exchange plugin, where the add_binding/3 function parses the routing key as an integer weight without enforcing an upper bound. An authenticated user with write permission on a consistent-hash exchange and read permission on a queue can create a binding with an arbitrarily large weight. The broker allocates a list of that many integers through lists:seq/2, persists it to Khepri, and replicates it cluster-wide. A single binding with weight 100,000,000 consumes roughly 800 MB of memory on every node and survives restarts.
Critical Impact
A single malicious binding can exhaust memory across all RabbitMQ cluster nodes and persist through restarts, resulting in denial of service.
Affected Products
- RabbitMQ versions prior to 3.13.15
- RabbitMQ 4.0.x prior to 4.0.20, 4.1.x prior to 4.1.11, and 4.2.x prior to 4.2.6
- Deployments with the rabbitmq_consistent_hash_exchange plugin enabled
Discovery Timeline
- 2026-09-23 - CVE-2026-67219 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-67219
Vulnerability Analysis
The vulnerability is a classic case of unbounded resource allocation controlled by an authenticated attacker. The rabbitmq_consistent_hash_exchange plugin uses the routing key of a binding to represent a numeric weight N in the hash ring. The add_binding/3 function then generates ring positions using the Erlang expression lists:seq(NextN0, NextN0 + N - 1), producing a list of N integers.
The accompanying validate_binding/2 function enforces only the lower bound N >= 1. No upper bound exists. The resulting list is written to the exchange's Khepri record, which is RabbitMQ's replicated metadata store. Khepri synchronizes state across every cluster node and reloads it during broker restart.
An attacker with the minimum binding permissions can supply a weight such as 100000000, forcing each node to allocate roughly 800 MB. Because the state is persisted, restarting the affected nodes does not clear the condition and can prevent the cluster from recovering.
Root Cause
The root cause is missing input validation on the routing key value used as the hash-ring weight. The validate_binding/2 guard accepts any integer greater than or equal to 1, allowing the allocation size in lists:seq/2 to be attacker-controlled.
Attack Vector
Exploitation requires network access to the broker's management or AMQP interface and authenticated credentials with write permission on a consistent-hash exchange and read permission on a bound queue. These are standard binding permissions and are frequently granted to application service accounts. The attacker declares a binding whose routing key encodes a large integer weight, triggering allocation and cluster-wide replication.
No verified public exploit code is available at the time of publication. See the GitHub Security Advisory GHSA-m8pg-4x2h-jvgr for the upstream technical description.
Detection Methods for CVE-2026-67219
Indicators of Compromise
- Sudden growth in Erlang process memory or Khepri store size on one or more RabbitMQ nodes shortly after a binding operation.
- Presence of consistent-hash exchange bindings whose routing key is an unusually large integer value.
- Cluster nodes failing to restart cleanly or entering an out-of-memory state during metadata replay.
Detection Strategies
- Audit management API and AMQP logs for queue.bind or exchange.bind operations targeting consistent-hash exchanges with numeric routing keys above a sane threshold (for example, greater than 1000).
- Query the broker with rabbitmqctl list_bindings and flag entries on x-consistent-hash exchanges whose routing key exceeds an operational baseline.
- Correlate rapid memory pressure alarms across multiple cluster nodes with recent binding creation events.
Monitoring Recommendations
- Enable RabbitMQ memory and disk alarms and forward them to a centralized monitoring system.
- Track per-exchange binding counts and routing-key statistics as time-series metrics.
- Alert on Khepri replication size deltas that exceed expected change rates for the environment.
How to Mitigate CVE-2026-67219
Immediate Actions Required
- Upgrade to RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0, which enforce an upper bound on the hash-ring weight.
- Inventory existing bindings on consistent-hash exchanges and remove any with anomalously large routing-key values before restarting nodes.
- Restrict write permissions on consistent-hash exchanges to trusted service accounts only.
Patch Information
The issue is fixed in RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. Release artifacts and changelogs are published at the RabbitMQ Release v4.2.6 and RabbitMQ Release v4.3.0 pages.
Workarounds
- Disable the rabbitmq_consistent_hash_exchange plugin if it is not required by any application.
- Revoke configure and write permissions on consistent-hash exchanges from untrusted users and application identities.
- Enforce network-level access controls on the AMQP and management interfaces to limit which clients can create bindings.
# Disable the vulnerable plugin on a RabbitMQ node
rabbitmq-plugins disable rabbitmq_consistent_hash_exchange
# Restrict permissions for an application user to a specific vhost and pattern
rabbitmqctl set_permissions -p /prod app_user "^app\." "^app\." "^app\."
# List existing bindings to identify anomalous routing keys
rabbitmqctl list_bindings source_name destination_name routing_key
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
