---
id: CVE-2026-66074
title: RabbitMQ is a messaging and streaming broker
summary: >-
  RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15,
  4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied
  ?name= regular expression to re:run with no match_limit option, and executes
  it once per re…
severity: medium
cvss: 6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-1333
vendor: rabbitmq
product: rabbitmq-server
affected:
  - 'rabbitmq-server >= 3.13.0, < 3.13.15'
  - 'rabbitmq-server >= 4.0.0, < 4.0.20'
  - 'rabbitmq-server >= 4.1.0, < 4.1.11'
  - 'rabbitmq-server >= 4.2.0, < 4.2.6'
published: '2026-09-23'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T21:16:59.357'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66074'
references:
  - url: 'https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6'
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-rg5q-vcgf-rfh7
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66074.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-66074'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2539788'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-66074'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66074'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67552'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
cvssSource: cna
ingestedAt: '2026-09-23T21:33:13.528Z'
patched:
  - hardened_images
scores:
  cna: 6
  vendor: 6.5
---

## Overview

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name= regular expression to re:run with no match_limit option, and executes it once per resource in the result set. OTP's default 10M match_limit caps each call at roughly 100-200ms, but the regex runs once per resource in the result set. With a large set, for example 5000 queues at 150ms each, a single request consumes 12 or more minutes of CPU. Parallel requests saturate the schedulers. The use_regex=true option is a supported feature on list endpoints, so this path is reachable through normal API use. Preconditions include Any user with the management tag can exploit this.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **RHSA-2026:67552** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67552)
- **Red Hat VEX** · Moderate · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-09-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66074.json)