This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-66080 →

DEBIAN-CVE-2026-66080

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validate_partitions only checks that the requested partition...

Original description

The description as published by the source.

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validate_partitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq(0, 500000000) allocates roughly 8GB. Preconditions include The rabbitmq_stream_management plugin must be enabled. The caller needs the management tag and access to the target vhost.. This issue is fixed in versions 4.1.11, 4.2.6, and 4.3.0.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:13 rabbitmq-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 rabbitmq-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2"}]}]

References

advisory security-tracker.debian.org