CVE-2026-67418

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmq_mqtt/src/rabbit_mqtt_packet.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated publisher with topic write permission can cause the broker to store and route that inapplicable property to a separately authenticated matching subscriber. When the subscriber path serializes the outbound PUBLISH, serialise_prop/2 has no matching clause, and the uncontained function_clause exception closes the victim MQTT or Web MQTT connection. The publisher connection and broker remain available, and queued replay, retained-message persistence, and broker-wide denial of service were not established. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

CVSS

No CVSS.

References

Link	Resource
https://github.com/rabbitmq/rabbitmq-server/commit/4639a4318c72a0660e4bc014767fad70ce288fbc
https://github.com/rabbitmq/rabbitmq-server/commit/908f944a1d581d10774f8d6d0dcf2a1a713779fb
https://github.com/rabbitmq/rabbitmq-server/pull/17035
https://github.com/rabbitmq/rabbitmq-server/pull/17287
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-jv99-v328-mvmm

Configurations

No configuration.

History

14 Oct 2026, 17:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-14 17:18

Updated : 2026-10-16 16:00

NVD link : CVE-2026-67418

Mitre link : CVE-2026-67418

CVE.ORG link : CVE-2026-67418

JSON object : View

Products Affected

No product.

CWE

CWE-248

Uncaught Exception

CWE-1286

Improper Validation of Syntactic Correctness of Input

{"id": "CVE-2026-67418", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67418", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-14T17:52:54.774490Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "rabbitmq", "product": "rabbitmq-server", "versions": [{"status": "affected", "version": ">= 3.13.0, < 3.13.19"}, {"status": "affected", "version": ">= 4.0.0, < 4.0.24"}, {"status": "affected", "version": ">= 4.1.0, < 4.1.15"}, {"status": "affected", "version": ">= 4.2.0, < 4.2.10"}, {"status": "affected", "version": ">= 4.3.0, < 4.3.5"}]}]}], "published": "2026-10-14T17:18:30.760", "references": [{"url": "https://github.com/rabbitmq/rabbitmq-server/commit/4639a4318c72a0660e4bc014767fad70ce288fbc", "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-server/commit/908f944a1d581d10774f8d6d0dcf2a1a713779fb", "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-server/pull/17035", "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-server/pull/17287", "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.5", "source": "security-advisories@github.com"}, {"url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-jv99-v328-mvmm", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-248"}, {"lang": "en", "value": "CWE-1286"}]}], "descriptions": [{"lang": "en", "value": "RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, the MQTT 5 parser in deps/rabbitmq_mqtt/src/rabbit_mqtt_packet.erl accepts Request-Problem-Information on PUBLISH packets even though the property is valid only for CONNECT. An authenticated publisher with topic write permission can cause the broker to store and route that inapplicable property to a separately authenticated matching subscriber. When the subscriber path serializes the outbound PUBLISH, serialise_prop/2 has no matching clause, and the uncontained function_clause exception closes the victim MQTT or Web MQTT connection. The publisher connection and broker remain available, and queued replay, retained-message persistence, and broker-wide denial of service were not established. This issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5."}], "lastModified": "2026-10-16T16:00:33.533", "sourceIdentifier": "security-advisories@github.com"}