RabbitMQ CVE-2024-47026: Low-Privilege DoS via Stream Management with PoC

RabbitMQ Vulnerability Summary Vulnerability Overview Vulnerability Name: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service Vulnerability Type: Denial of Service (DoS) Severity: High (CVSS 7.1) CVE ID: CVE-2024-47026 CWE ID: CWE-400 (Uncontrolled Resource Consumption) Description: RabbitMQ 4.3.1 contains a denial-of-service vulnerability affecting low-privilege users when the plugin is enabled. An attacker (possessing the tag but lacking , , or permissions) can trigger a server-side memory exhaustion by sending a request to containing an excessively long field. This forces the server to construct a massive list of strings before resource permission checks occur, leading to Out Of Memory (OOM) errors and the termination of RabbitMQ nodes by the OOM Killer. Affected Versions Affected Versions: Fixed Versions: 4.3.3 4.2.9 4.1.11 Affected Component: (RabbitMQ) Remediation Recommended Actions: 1. Upgrade Version: Upgrade RabbitMQ to one of the fixed versions (4.3.3, 4.2.9, or 4.1.11). 2. Code Fix Logic (Official Recommendation): Perform resource permission checks before expanding into a full list of stream names. Enforce a maximum byte length limit for before constructing the list. Avoid converting large, unbounded binary data (e.g., using and ) prior to authorization. Return an explicit rejection response for users who cannot configure the target super-stream, rather than proceeding with the allocation of data for each binding key. POC / Exploit Code A Python script, , is provided on the page to verify the vulnerability. Safe Command (Low-Load Verification): Destructive Command (Trigger OOM): Environment Setup Command (Docker):**

Goal Reached Thanks to every supporter — we hit 100%!

RabbitMQ CVE-2024-47026: Low-Privilege DoS via Stream Management with PoC

More from this source