CVE-2026-67232: RabbitMQ Web-MQTT Plugin DOS Vulnerability

CVE-2026-67232 Overview

CVE-2026-67232 is a denial-of-service vulnerability in RabbitMQ's Web-MQTT plugin. The flaw stems from unbounded zlib decompression during WebSocket frame handling. An unauthenticated remote attacker can send a single highly-compressed WebSocket frame — a few kilobytes on the wire — that expands to gigabytes in memory, crashing the RabbitMQ node.

The issue affects RabbitMQ deployments with the rabbitmq_web_mqtt plugin enabled, which is common for browser-based MQTT clients. Fixed versions are 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Critical Impact
An unauthenticated attacker with network access to port 15675 or 15676 can crash a RabbitMQ broker with a single compressed WebSocket frame, disrupting messaging infrastructure and dependent applications.

Affected Products

RabbitMQ Server versions prior to 3.13.15
RabbitMQ Server 4.0.x prior to 4.0.20, 4.1.x prior to 4.1.11, and 4.2.x prior to 4.2.6
Deployments with the rabbitmq_web_mqtt plugin enabled

Discovery Timeline

2026-09-23 - CVE-2026-67232 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-67232

Vulnerability Analysis

The Web-MQTT plugin uses cowboy's WebSocket options with compress => true, enabling RFC 7692 permessage-deflate negotiation. The handler does not configure max_frame_size, so cowboy applies its default of infinity. When a compressed frame arrives, cowlib's cow_ws:parse_payload/9 invokes zlib:inflate/2 on the payload without any output-size limit.

An attacker negotiates permessage-deflate during the WebSocket upgrade, then transmits a zlib bomb such as a 50 KB payload that inflates to 5 GB. Decompression happens inside the connection process before websocket_handle/2 receives any MQTT bytes. The Erlang virtual machine exhausts memory and the RabbitMQ node terminates.

This is classified as an improper handling of highly compressed data resource consumption issue [CWE-409].

Root Cause

The root cause is the absence of a bounded output-size limit on zlib decompression inside the WebSocket handler. Combined with an unbounded max_frame_size, the connection process accepts and inflates arbitrarily large payloads. Memory pressure in the Erlang VM causes the node to crash before authentication or MQTT protocol handling occurs.

Attack Vector

The attack requires network reachability to the Web-MQTT listener on port 15675 (plaintext) or 15676 (TLS). No credentials are required because decompression occurs before the MQTT CONNECT packet is parsed. The attacker performs a standard WebSocket upgrade, advertises permessage-deflate support, then sends one compressed frame containing a zlib bomb.

For technical details, consult the GitHub Security Advisory GHSA-gmgx-hhg5-43gr.

Detection Methods for CVE-2026-67232

Indicators of Compromise

Sudden RabbitMQ node crashes or restarts correlated with inbound traffic to TCP 15675 or 15676.
Erlang VM memory spikes preceding node termination, visible in RabbitMQ management metrics or beam.smp process telemetry.
WebSocket upgrade requests to /ws endpoints that include Sec-WebSocket-Extensions: permessage-deflate from untrusted source addresses.

Detection Strategies

Inspect reverse proxy or load balancer logs for WebSocket upgrade requests to Web-MQTT endpoints that advertise permessage-deflate from external clients.
Monitor RabbitMQ crash dumps and Erlang erl_crash.dump files for out-of-memory conditions on connection processes tied to the rabbit_web_mqtt_handler.
Alert on repeated broker restarts or supervisor-tree failures affecting the rabbitmq_web_mqtt application.

Monitoring Recommendations

Track memory consumption of beam.smp and per-connection memory reported by rabbitmqctl status.
Ingest broker logs and crash dumps into a centralized analytics platform to correlate DoS attempts across nodes.
Baseline typical WebSocket frame sizes for MQTT clients and alert on frames whose compression ratio exceeds expected norms.

How to Mitigate CVE-2026-67232

Immediate Actions Required

Upgrade RabbitMQ to 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 — see the RabbitMQ Server Release v4.2.6 and RabbitMQ Server Release v4.3.0 release notes.
If patching is not immediate, disable the rabbitmq_web_mqtt plugin with rabbitmq-plugins disable rabbitmq_web_mqtt on hosts that do not require browser MQTT clients.
Restrict inbound network access to ports 15675 and 15676 so only trusted client networks or an authenticating reverse proxy can reach the Web-MQTT listener.

Patch Information

The RabbitMQ maintainers fixed the issue in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. The patch constrains WebSocket frame size and bounds decompression output. Refer to the GitHub Security Advisory GHSA-gmgx-hhg5-43gr for the full fix description.

Workarounds

Terminate WebSocket connections at a reverse proxy that enforces a maximum frame size and rejects permessage-deflate negotiation from untrusted clients.
Place the Web-MQTT listener behind a VPN or mutually authenticated TLS to remove unauthenticated exposure.
Apply operating-system memory limits (for example, cgroups) to the RabbitMQ service so a single node crash does not affect co-located workloads.

bash

# Disable the vulnerable plugin until patched
rabbitmq-plugins disable rabbitmq_web_mqtt

# Restrict Web-MQTT ports to trusted networks (Linux iptables example)
iptables -A INPUT -p tcp --dport 15675 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 15676 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 15675 -j DROP
iptables -A INPUT -p tcp --dport 15676 -j DROP