{"id":28254,"date":"2026-09-24T08:31:37","date_gmt":"2026-09-24T00:31:37","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-67220"},"modified":"2026-09-24T08:31:37","modified_gmt":"2026-09-24T00:31:37","slug":"cve-2026-67220","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-67220","title":{"rendered":"CVE-2026-67220 &#8211; RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4"},"content":{"rendered":"<p>RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, When a binding is created on an x-jms-topic exchange, add_binding\/3 reads the rjms_erlang_selector argument and passes it through erl_scan:string\/1 then erl_parse:parse_term\/1. erl_scan:string\/1 interns every atom literal it tokenizes. validate_binding\/2 is a no-op (-&gt; ok.), there is no length cap, and the surrounding try\/catch cannot reclaim atoms. The Java JMS client compiles selectors client-side, but the server does not enforce this , a raw AMQP client can send arbitrary selector strings. An authenticated low-privilege AMQP user confined to one vhost can crash the entire broker node (cross-tenant DoS) in &lt;100 bind calls. Preconditions include rabbitmq_jms_topic_exchange plugin enabled (bundled; required for any JMS deployment) Authenticated AMQP user with read on an x-jms-topic exchange + write on a queue (or configure to declare both). This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0, When a binding is created on an x-jms-topic exchange, add_binding\/3 reads the rjms_erlang_selecto<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28254","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28254","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28254"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28254"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28254"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}