---
id: CVE-2026-67240
title: RabbitMQ is a messaging and streaming broker
summary: >-
  RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and
  4.3.1, pattern_to_regex maps % -> .*? and _ -> ., then compiles ^...$ with
  only [unicode]; re:run is called with only [{capture, none}] - no explicit
  match_limit. …
severity: low
cvss: 2.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'
cwe:
  - CWE-1333
vendor: rabbitmq
product: rabbitmq-server
affected:
  - 'rabbitmq-server >= 4.2.0, < 4.2.7'
  - 'rabbitmq-server >= 4.3.0, < 4.3.1'
published: '2026-09-23'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T15:17:29.910'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67240'
references:
  - url: 'https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7'
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1'
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-59c5-553c-57m2
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-59c5-553c-57m2
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67240.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-67240'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2539764'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-67240'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67240'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67552'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
  - score-dispute
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T14:24:20.497820Z'
cvssSource: cna
scores:
  cna: 2.3
  vendor: 6.5
ingestedAt: '2026-09-23T20:32:10.758Z'
patched:
  - hardened_images
epss: 0.00259
epssPercentile: 0.15749
---

## Overview

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, pattern_to_regex maps % -> .*? and _ -> ., then compiles ^...$ with only [unicode]; re:run is called with only [{capture, none}] - no explicit match_limit. A pattern like %_%_..._%X becomes ^.*?..*?.....*?.X$ with overlapping lazy quantifiers. The whole-expression cap is ?MAX_EXPRESSION_LENGTH=4096 chars / ?MAX_TOKENS=200; a LIKE string literal is one token, so ~2000 %_ pairs fit. SQL filters are accepted unconditionally at rabbit_amqp_session.erl:3264 (no feature flag). Evaluated per-message at rabbit_stream_queue.erl:1439. OTP's default 10M match_limit caps each match at ~100-200 ms (not seconds), and the re NIF yields to the scheduler. An authenticated AMQP 1.0 consumer with read+write on a stream queue can cause ~100-200 ms of CPU per delivered message via a crafted LIKE filter, multiplied across thousands of messages and parallel sessions - a substantial backtracking-driven CPU amplification. Preconditions include AMQP 1.0 with stream queues in use Attacker can attach a receiver with a filter (read permission) and publish messages with long property values (write permission). This issue is fixed in versions 4.2.7 and 4.3.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Hardened Images · no fix planned: Red Hat Hardened Images · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67240.json)
- **RHSA-2026:67552** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67552)