--- title: "CVE-2026-66079\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2026-66079?format=md keywords: index, follow --- # CVE-2026-66079 Publication date 24 September 2026 Last updated 24 September 2026 --- Ubuntu priority **Medium** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse\_array\_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consuming B bytes each , with B = 0, no input is consumed and the loop builds a list of Count empty elements bounded only by the 32-bit field. The SASL-mechanisms / SASL-init frame is parsed by amqp10\_framing:decode\_bin/1 from rabbit\_amqp\_reader.erl:412 before authentication completes. The pre-auth incoming\_max\_frame\_size (default 8192 bytes) caps the frame, not the Count field, so a 19-byte payload with Count = 0xFFFFFFFF is accepted. No max\_heap\_size is set on the reader process. An unauthenticated network attacker can crash any RabbitMQ node that has the AMQP 1.0 listener enabled (default port 5672) by sending a single ~19-byte frame. The reader process attempts to build a list of ~4 billion empty elements, exhausting heap memory and terminating the Erlang VM. All tenants and protocols on the node lose service. Preconditions include Network reachability to the AMQP listener (port 5672, enabled by default) No authentication required. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | rabbitmq-server | 26.04 LTS resolute | Needs evaluation | | 24.04 LTS noble | Needs evaluation | | 22.04 LTS jammy | Needs evaluation | | 20.04 LTS focal | Needs evaluation | | 18.04 LTS bionic | Needs evaluation | | 16.04 LTS xenial | Needs evaluation | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Severity score breakdown CVSS version: CVSS v4.0 **Base score** 8.2 · High * Base metrics | Parameter | Value | | --- | --- | | Attack vector | Network | | Attack complexity | Low | | Attack requirements | Present | | Privileges required | None | | User interaction | None | | Vulnerable system - Confidentiality impact | None | | Vulnerable system - Integrity impact | None | | Vulnerable system - Availability impact | High | | Subsequent system - Confidentiality impact | None | | Subsequent system - Integrity impact | None | | Subsequent system - Availability impact | None | * Scores | Parameter | Value | | --- | --- | | Base score | 8.2 · High | | Base + Threat score | - | | Base + Environmental score | - | | Base + Threat + Environmental score | - | **Vector:** CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-66079) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-66079) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2026-66079) * [Debian](https://security-tracker.debian.org/tracker/CVE-2026-66079) ### Other references * * *