CVE catalog
CVE-2026-66079
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The e
- Severity
- Critical · CVSS 9.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.32% · Oct 25, 2026
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10_framing:decode_bin/1 from rabbit_amqp_reader.erl:412 before authentication completes. The pre-auth incoming_max_frame_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max_heap_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rabbitmq-server | sid | 4.3.6-1 | fixed |
| Debian | rabbitmq-server | forky | 4.3.6-1 | fixed |
| Debian | rabbitmq-server | trixie | 4.0.5-6+deb13u2 | vulnerable |
| Debian | rabbitmq-server | bookworm | 3.10.8-1.1+deb12u1 | vulnerable |
| Debian | rabbitmq-server | bookworm-security | 3.10.8-1.1+deb12u1 | vulnerable |
| Ubuntu | rabbitmq-server | noble | 3.12.1-1ubuntu1.7 | fixed |
| Ubuntu:Pro:16.04:LTS | rabbitmq-server | Not reported | 3.5.4-1 | vulnerable |
| Ubuntu:Pro:16.04:LTS | rabbitmq-server | Not reported | 3.5.4-3 | vulnerable |
| Ubuntu:Pro:16.04:LTS | rabbitmq-server | Not reported | 3.5.4-3.1 | vulnerable |
| Ubuntu:Pro:16.04:LTS | rabbitmq-server | Not reported | 3.5.7-1 | vulnerable |
| Ubuntu:Pro:16.04:LTS | rabbitmq-server | Not reported | 3.5.7-1ubuntu0.16.04.1 | vulnerable |
| Ubuntu:Pro:16.04:LTS | rabbitmq-server | Not reported | 3.5.7-1ubuntu0.16.04.2 | vulnerable |
| Ubuntu:Pro:16.04:LTS | rabbitmq-server | Not reported | 3.5.7-1ubuntu0.16.04.4 | vulnerable |
| Ubuntu:Pro:16.04:LTS | rabbitmq-server | Not reported | 3.5.7-1ubuntu0.16.04.4+esm1 | vulnerable |
| Ubuntu:Pro:16.04:LTS | rabbitmq-server | Not reported | 3.5.7-1ubuntu0.16.04.4+esm2 | vulnerable |
| Ubuntu:Pro:16.04:LTS | rabbitmq-server | Not reported | 3.5.7-1ubuntu0.16.04.4+esm3 | fixed |
| Ubuntu:Pro:18.04:LTS | rabbitmq-server | Not reported | 3.6.10-1 | vulnerable |
| Ubuntu:Pro:18.04:LTS | rabbitmq-server | Not reported | 3.6.10-1ubuntu0.1 | vulnerable |
| Ubuntu:Pro:18.04:LTS | rabbitmq-server | Not reported | 3.6.10-1ubuntu0.3 | vulnerable |
| Ubuntu:Pro:18.04:LTS | rabbitmq-server | Not reported | 3.6.10-1ubuntu0.4 | vulnerable |
| Ubuntu:Pro:18.04:LTS | rabbitmq-server | Not reported | 3.6.10-1ubuntu0.5 | vulnerable |
| Ubuntu:Pro:18.04:LTS | rabbitmq-server | Not reported | 3.6.10-1ubuntu0.5+esm1 | fixed |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Not reported | 3.7.8-4ubuntu2 | vulnerable |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Not reported | 3.7.18-1 | vulnerable |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Not reported | 3.8.2-0ubuntu1 | vulnerable |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Not reported | 3.8.2-0ubuntu1.1 | vulnerable |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Not reported | 3.8.2-0ubuntu1.2 | vulnerable |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Not reported | 3.8.2-0ubuntu1.3 | vulnerable |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Not reported | 3.8.2-0ubuntu1.4 | vulnerable |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Not reported | 3.8.2-0ubuntu1.5 | vulnerable |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Not reported | 3.8.3-0ubuntu0.1 | vulnerable |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Not reported | 3.8.3-0ubuntu0.2 | vulnerable |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Not reported | 3.8.3-0ubuntu0.3 | vulnerable |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Not reported | 3.8.3-0ubuntu0.3+esm1 | vulnerable |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Not reported | 3.8.3-0ubuntu0.3+esm2 | fixed |
| Ubuntu:22.04:LTS | rabbitmq-server | Not reported | 3.8.9-3ubuntu1 | vulnerable |
| Ubuntu:22.04:LTS | rabbitmq-server | Not reported | 3.9.8-1 | vulnerable |
| Ubuntu:22.04:LTS | rabbitmq-server | Not reported | 3.9.8-2 | vulnerable |
| Ubuntu:22.04:LTS | rabbitmq-server | Not reported | 3.9.8-3 | vulnerable |
| Ubuntu:22.04:LTS | rabbitmq-server | Not reported | 3.9.8-5 | vulnerable |
| Ubuntu:22.04:LTS | rabbitmq-server | Not reported | 3.9.8-6 | vulnerable |
| Ubuntu:22.04:LTS | rabbitmq-server | Not reported | 3.9.13-1 | vulnerable |
| Ubuntu:22.04:LTS | rabbitmq-server | Not reported | 3.9.13-1ubuntu0.22.04.1 | vulnerable |
| Ubuntu:22.04:LTS | rabbitmq-server | Not reported | 3.9.13-1ubuntu0.22.04.2 | vulnerable |
| Ubuntu:22.04:LTS | rabbitmq-server | Not reported | 3.9.27-0ubuntu0.1 | vulnerable |
| Ubuntu:22.04:LTS | rabbitmq-server | Not reported | 3.9.27-0ubuntu0.2 | vulnerable |
| Ubuntu:22.04:LTS | rabbitmq-server | Not reported | 3.9.27-0ubuntu0.5 | vulnerable |
| Ubuntu:22.04:LTS | rabbitmq-server | Not reported | 3.9.27-0ubuntu0.6 | fixed |
| Ubuntu:24.04:LTS | rabbitmq-server | Not reported | 3.12.1-1 | vulnerable |
| Ubuntu:24.04:LTS | rabbitmq-server | Not reported | 3.12.1-1ubuntu1 | vulnerable |
| Ubuntu:24.04:LTS | rabbitmq-server | Not reported | 3.12.1-1ubuntu1.2 | vulnerable |
| Ubuntu:24.04:LTS | rabbitmq-server | Not reported | 3.12.1-1ubuntu1.4 | vulnerable |
| Ubuntu:24.04:LTS | rabbitmq-server | Not reported | 3.12.1-1ubuntu1.6 | vulnerable |
| Ubuntu:24.04:LTS | rabbitmq-server | Not reported | 3.12.1-1ubuntu1.7 | fixed |
| Ubuntu:26.04:LTS | rabbitmq-server | Not reported | 4.0.5-8ubuntu2 | vulnerable |
| Ubuntu:26.04:LTS | rabbitmq-server | Not reported | 4.0.5-10ubuntu1 | vulnerable |
| Ubuntu:26.04:LTS | rabbitmq-server | Not reported | 4.0.5-10ubuntu2 | vulnerable |
| Ubuntu:26.04:LTS | rabbitmq-server | Not reported | 4.0.5-10ubuntu3 | vulnerable |
| Ubuntu:26.04:LTS | rabbitmq-server | Not reported | 4.0.5-10ubuntu4 | vulnerable |
| Ubuntu:26.04:LTS | rabbitmq-server | Not reported | 4.0.5-10ubuntu5 | vulnerable |
| Ubuntu:26.04:LTS | rabbitmq-server | Not reported | 4.0.5-10ubuntu5.1 | vulnerable |
| Ubuntu:26.04:LTS | rabbitmq-server | Not reported | 4.0.5-10ubuntu5.2 | fixed |
| Cpe | rabbitmq_server | Not reported | 4.2.6 | fixed |
| Ubuntu | rabbitmq-server | pro | 3.7.8-4ubuntu2 | vulnerable |
| Ubuntu | rabbitmq-server | pro | 3.7.18-1 | vulnerable |
| Ubuntu | rabbitmq-server | pro | 3.8.2-0ubuntu1 | vulnerable |
| Ubuntu | rabbitmq-server | pro | 3.8.2-0ubuntu1.1 | vulnerable |
| Ubuntu | rabbitmq-server | pro | 3.8.2-0ubuntu1.2 | vulnerable |
| Ubuntu | rabbitmq-server | pro | 3.8.2-0ubuntu1.3 | vulnerable |
| Ubuntu | rabbitmq-server | pro | 3.8.2-0ubuntu1.4 | vulnerable |
| Ubuntu | rabbitmq-server | pro | 3.8.2-0ubuntu1.5 | vulnerable |
| Ubuntu | rabbitmq-server | pro | 3.8.3-0ubuntu0.1 | vulnerable |
| Ubuntu | rabbitmq-server | pro | 3.8.3-0ubuntu0.2 | vulnerable |
| Ubuntu | rabbitmq-server | pro | 3.8.3-0ubuntu0.3 | vulnerable |
| Ubuntu | rabbitmq-server | pro | 3.8.3-0ubuntu0.3+esm1 | vulnerable |
| Ubuntu | rabbitmq-server | pro | 3.8.3-0ubuntu0.3+esm2 | fixed |
| Ubuntu | rabbitmq-server | 22.04 | 3.8.9-3ubuntu1 | vulnerable |
| Ubuntu | rabbitmq-server | 22.04 | 3.9.8-1 | vulnerable |
| Ubuntu | rabbitmq-server | 22.04 | 3.9.8-2 | vulnerable |
| Ubuntu | rabbitmq-server | 22.04 | 3.9.8-3 | vulnerable |
| Ubuntu | rabbitmq-server | 22.04 | 3.9.8-5 | vulnerable |
| Ubuntu | rabbitmq-server | 22.04 | 3.9.8-6 | vulnerable |
| Ubuntu | rabbitmq-server | 22.04 | 3.9.13-1 | vulnerable |
| Ubuntu | rabbitmq-server | 22.04 | 3.9.13-1ubuntu0.22.04.1 | vulnerable |
| Ubuntu | rabbitmq-server | 22.04 | 3.9.13-1ubuntu0.22.04.2 | vulnerable |
| Ubuntu | rabbitmq-server | 22.04 | 3.9.27-0ubuntu0.1 | vulnerable |
| Ubuntu | rabbitmq-server | 22.04 | 3.9.27-0ubuntu0.2 | vulnerable |
| Ubuntu | rabbitmq-server | 22.04 | 3.9.27-0ubuntu0.5 | vulnerable |
| Ubuntu | rabbitmq-server | 22.04 | 3.9.27-0ubuntu0.6 | fixed |
| Ubuntu | rabbitmq-server | 24.04 | 3.12.1-1 | vulnerable |
| Ubuntu | rabbitmq-server | 24.04 | 3.12.1-1ubuntu1 | vulnerable |
| Ubuntu | rabbitmq-server | 24.04 | 3.12.1-1ubuntu1.2 | vulnerable |
| Ubuntu | rabbitmq-server | 24.04 | 3.12.1-1ubuntu1.4 | vulnerable |
| Ubuntu | rabbitmq-server | 24.04 | 3.12.1-1ubuntu1.6 | vulnerable |
| Ubuntu | rabbitmq-server | 24.04 | 3.12.1-1ubuntu1.7 | fixed |
| Ubuntu | rabbitmq-server | 26.04 | 4.0.5-8ubuntu2 | vulnerable |
| Ubuntu | rabbitmq-server | 26.04 | 4.0.5-10ubuntu1 | vulnerable |
| Ubuntu | rabbitmq-server | 26.04 | 4.0.5-10ubuntu2 | vulnerable |
| Ubuntu | rabbitmq-server | 26.04 | 4.0.5-10ubuntu3 | vulnerable |
| Ubuntu | rabbitmq-server | 26.04 | 4.0.5-10ubuntu4 | vulnerable |
| Ubuntu | rabbitmq-server | 26.04 | 4.0.5-10ubuntu5 | vulnerable |
| Ubuntu | rabbitmq-server | 26.04 | 4.0.5-10ubuntu5.1 | vulnerable |
| Ubuntu | rabbitmq-server | 26.04 | 4.0.5-10ubuntu5.2 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rabbitmq-server | source | sid | 4.3.0-2 | not yet assigned | Not reported | Not reported |
| Debian | rabbitmq-server | source | forky | 4.3.0-2 | not yet assigned | Not reported | Not reported |
| Debian | rabbitmq-server | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | rabbitmq-server | source | bookworm | (unfixed) | not yet assigned | Not reported | Not reported |
| Ubuntu | rabbitmq-server | deb | noble | 3.12.1-1ubuntu1.7 | Not reported | Not reported | Not reported |
| Ubuntu:Pro:16.04:LTS | rabbitmq-server | Ubuntu:Pro:16.04:LTS | Not reported | 3.5.7-1ubuntu0.16.04.4+esm3 | Not reported | USN-8933-1 | Not reported |
| Ubuntu:Pro:18.04:LTS | rabbitmq-server | Ubuntu:Pro:18.04:LTS | Not reported | 3.6.10-1ubuntu0.5+esm1 | Not reported | USN-8933-1 | Not reported |
| Ubuntu:Pro:20.04:LTS | rabbitmq-server | Ubuntu:Pro:20.04:LTS | Not reported | 3.8.3-0ubuntu0.3+esm2 | Not reported | USN-8933-1 | Not reported |
| Ubuntu:22.04:LTS | rabbitmq-server | Ubuntu:22.04:LTS | Not reported | 3.9.27-0ubuntu0.6 | Not reported | USN-8933-1 | Not reported |
| Ubuntu:24.04:LTS | rabbitmq-server | Ubuntu:24.04:LTS | Not reported | 3.12.1-1ubuntu1.7 | Not reported | USN-8933-1 | Not reported |
| Ubuntu:26.04:LTS | rabbitmq-server | Ubuntu:26.04:LTS | Not reported | 4.0.5-10ubuntu5.2 | Not reported | USN-8933-1 | Not reported |
| Cpe | rabbitmq_server | cpe | Not reported | 4.2.6 | Not reported | NVD-CVE-2026-66079 | Not reported |
| Ubuntu | rabbitmq-server | deb | pro | 3.8.3-0ubuntu0.3+esm2 | Not reported | UBUNTU-CVE-2026-66079 | Not reported |
| Ubuntu | rabbitmq-server | deb | 22.04 | 3.9.27-0ubuntu0.6 | Not reported | UBUNTU-CVE-2026-66079 | Not reported |
| Ubuntu | rabbitmq-server | deb | 24.04 | 3.12.1-1ubuntu1.7 | Not reported | UBUNTU-CVE-2026-66079 | Not reported |
| Ubuntu | rabbitmq-server | deb | 26.04 | 4.0.5-10ubuntu5.2 | Not reported | UBUNTU-CVE-2026-66079 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [rabbitmq-server]Affected
Details (4)
3.10.8-1.1+deb12u1· all · bookwormAffected · Fixed:
3.12.1-1ubuntu1.7, 3.5.7-1ubuntu0.16.04.4+esm3, 3.6.10-1ubuntu0.5+esm1, 3.8.3-0ubuntu0.3+esm2, 3.9.27-0ubuntu0.6, 4.0.5-10ubuntu5.2nvd · rabbitmq-server · debian · bookworm; nvd · rabbitmq-server; nvd · rabbitmq-server · debian · 12
3.10.8-1.1+deb12u1· all · bookwormAffected · Fixed:
3.12.1-1ubuntu1.7, 3.5.7-1ubuntu0.16.04.4+esm3, 3.6.10-1ubuntu0.5+esm1, 3.8.3-0ubuntu0.3+esm2, 3.9.27-0ubuntu0.6, 4.0.5-10ubuntu5.2nvd · rabbitmq-server · debian · bookworm; nvd · rabbitmq-server; nvd · rabbitmq-server · debian · 12
3.10.8-1.1+deb12u1· all · bookworm-securityAffected · Fixed:
3.12.1-1ubuntu1.7, 3.5.7-1ubuntu0.16.04.4+esm3, 3.6.10-1ubuntu0.5+esm1, 3.8.3-0ubuntu0.3+esm2, 3.9.27-0ubuntu0.6, 4.0.5-10ubuntu5.2nvd · rabbitmq-server · debian · bookworm; nvd · rabbitmq-server; nvd · rabbitmq-server · debian · 12
3.10.8-1.1+deb12u1· all · bookworm-securityAffected · Fixed:
3.12.1-1ubuntu1.7, 3.5.7-1ubuntu0.16.04.4+esm3, 3.6.10-1ubuntu0.5+esm1, 3.8.3-0ubuntu0.3+esm2, 3.9.27-0ubuntu0.6, 4.0.5-10ubuntu5.2nvd · rabbitmq-server · debian · bookworm; nvd · rabbitmq-server; nvd · rabbitmq-server · debian · 12
[Debian 13 (Trixie)]
- [rabbitmq-server]Affected
Details (2)
4.0.5-6+deb13u2· all · trixieAffected · Fixed:
3.12.1-1ubuntu1.7, 3.5.7-1ubuntu0.16.04.4+esm3, 3.6.10-1ubuntu0.5+esm1, 3.8.3-0ubuntu0.3+esm2, 3.9.27-0ubuntu0.6, 4.0.5-10ubuntu5.2nvd · rabbitmq-server; nvd · rabbitmq-server · debian · 13
4.0.5-6+deb13u2· all · trixieAffected · Fixed:
3.12.1-1ubuntu1.7, 3.5.7-1ubuntu0.16.04.4+esm3, 3.6.10-1ubuntu0.5+esm1, 3.8.3-0ubuntu0.3+esm2, 3.9.27-0ubuntu0.6, 4.0.5-10ubuntu5.2nvd · rabbitmq-server; nvd · rabbitmq-server · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-66079]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-66079]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-66079]
- [https://osv.dev/vulnerability/USN-8933-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-66079]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66079.json]
- [https://ubuntu.com/security/notices/USN-8933-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2268.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]