CVE-2026-57220High· 7.5▾ TwilightRabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an una…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
0.5% → 1.0%
Last analysed / modified upstream
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, the RabbitMQ stream listener does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation, allowing an unauthenticated remote client to declare oversized frame lengths and consume broker memory in rabbit_stream_core. This issue is fixed in version 4.2.6.
rabbitmq_server >= 4.2.0, < 4.2.6Upgrade past the affected range:
rabbitmq_server 4.2.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67222Medium· 6.5RabbitMQ is a messaging and streaming broker
CVE-2026-66071Medium· 6.5RabbitMQ is a messaging and streaming broker
CVE-2026-66073Medium· 6.5RabbitMQ is a messaging and streaming broker
CVE-2026-66078Medium· 5.5RabbitMQ is a messaging and streaming broker
CVE-2026-67415Medium· 4.9RabbitMQ is a messaging and streaming broker
CVE-2026-57216Medium· 6.8RabbitMQ is a messaging and streaming broker