Bug 2547905

Summary:	CVE-2026-67419 rabbitmq-server: rabbitmq-server: Denial of Service via consecutive wildcards in topic binding keys [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Laura Pardo <lpardo>
Component:	rabbitmq-server	Assignee:	Peter Lemenkov <lemenkov>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	lemenkov, rjones
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["a3a32d0b-ef43-46e0-b50d-0e4763be499f"]}
Fixed In Version:	rabbitmq-server-4.3.6-1.fc46 rabbitmq-server-4.3.6-1.fc45	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-10-09 15:44:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2541534

Description Laura Pardo 2026-10-08 11:16:55 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. The matcher materializes duplicate destinations before deduplication, causing combinatorial CPU work and memory pressure that can disrupt routing for all tenants. This vulnerability is fixed in 4.3.5.

Comment 1 Peter Lemenkov 2026-10-09 13:24:46 UTC

This issue is already fixed upstream in RabbitMQ 4.3.6, which is the version currently built for Fedora rawhide (rabbitmq-server-4.3.6-1.fc46) and Fedora 45 (rabbitmq-server-4.3.6-1.fc45).

Fedora 44 (currently 4.2.9) and Fedora 43 (currently 4.0.9) still need attention; backports/rebases for the still-supported stable branches are being worked on. Leaving this report open to track that remaining work.

Comment 2 Peter Lemenkov 2026-10-09 15:44:38 UTC

This issue is already addressed in the rabbitmq-server builds currently shipped in all maintained Fedora branches:

  * Fedora rawhide: rabbitmq-server-4.3.6-1.fc46
  * Fedora 45:      rabbitmq-server-4.3.6-1.fc45
  * Fedora 44:      rabbitmq-server-4.2.9-2.fc44

Note: this particular issue only affects the 4.3.x line (>= 4.3.0, < 4.3.5); Fedora 44 (4.2.x) and Fedora 43 (4.0.x) are not affected. No new build is required, so closing as CURRENTRELEASE.

Fedora 43 (rabbitmq-server-4.0.9) will NOT be updated for this CVE batch: the upstream 4.0.x line ended at 4.0.9 (later 4.0.x fixes are commercial-only, with no public OSS release) and Fedora 43 reaches end of life on 2026-12-09, so a backport to F43 is not worthwhile.