Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive # segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. The matcher materializes duplicate destinations before deduplication, causing combinatorial CPU work and memory pressure that can disrupt routing for all tenants. This vulnerability is fixed in 4.3.5.
This issue is already fixed upstream in RabbitMQ 4.3.6, which is the version currently built for Fedora rawhide (rabbitmq-server-4.3.6-1.fc46) and Fedora 45 (rabbitmq-server-4.3.6-1.fc45). Fedora 44 (currently 4.2.9) and Fedora 43 (currently 4.0.9) still need attention; backports/rebases for the still-supported stable branches are being worked on. Leaving this report open to track that remaining work.
This issue is already addressed in the rabbitmq-server builds currently shipped in all maintained Fedora branches: * Fedora rawhide: rabbitmq-server-4.3.6-1.fc46 * Fedora 45: rabbitmq-server-4.3.6-1.fc45 * Fedora 44: rabbitmq-server-4.2.9-2.fc44 Note: this particular issue only affects the 4.3.x line (>= 4.3.0, < 4.3.5); Fedora 44 (4.2.x) and Fedora 43 (4.0.x) are not affected. No new build is required, so closing as CURRENTRELEASE. Fedora 43 (rabbitmq-server-4.0.9) will NOT be updated for this CVE batch: the upstream 4.0.x line ended at 4.0.9 (later 4.0.x fixes are commercial-only, with no public OSS release) and Fedora 43 reaches end of life on 2026-12-09, so a backport to F43 is not worthwhile.