CVE-2026-66080
MEDIUMCVSS 4.9Description
RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validate_partitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq(0, 500000000) allocates roughly 8GB. Preconditions include The rabbitmq_stream_management plugin must be enabled. The caller needs the management tag and access to the target vhost.. This issue is fixed in versions 4.1.11, 4.2.6, and 4.3.0.
Timeline
Published:September 23rd, 2026 9:16 PM
Last modified:October 19th, 2026 8:37 PM
CVSS Scoring
CVSS v3: 4.9 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected Software
From NVD CPE configuration data
Vendors
broadcom
Products
rabbitmq_server
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
Source: NIST NVD · Data may lag official sources by up to one minute