CyberRota Analysis
AI-GeneratedRabbitMQ versions 4.1.0 through 4.3.3, including 4.2.9 and 4.1.11, are vulnerable to a denial of service attack where low-privileged management users can exploit the Stream Management Super-Stream Binding Keys Allocation feature to exhaust memory resources. By sending a specially crafted HTTP PUT request, an attacker can cause the RabbitMQ container to crash, particularly in environments with memory limitations, such as those running on Docker. Organizations using affected RabbitMQ versions should prioritize upgrading to versions 4.3.3, 4.2.9, or 4.1.11 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/{vhost}/{name} requests from an authenticated management user that can access the target vhost. When the request body contains the binding-keys field, the handler parses the attacker-controlled comma-separated string and builds the full stream-name list before checking whether the user has permission to configure the resulting streams. A low-privileged management user with vhost access but no configure, write, or read permission can therefore force large transient allocations before the resource permission check. In a 768 MB memory-limited container, one HTTP PUT with about 4.5 MB of JSON body killed the RabbitMQ container with Docker state exited true An authenticated low-privileged management user can kill a memory-limited RabbitMQ node with one HTTP This issue is fixed in versions 4.3.3, 4.2.9, and 4.1.11.
Related CVEs
Other vulnerabilities affecting the same vendor(s)