Описание
Web-STOMP unbounded pre-auth accumulation
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Description
The WebSocket path in the Web-STOMP handler enforces neither a max_frame_size nor a login_timeout. The raw TCP STOMP reader has both, but the Web-STOMP handler was missed. A slow trickle of single-byte frames keeps a connection alive indefinitely before authentication, allowing unbounded pre-auth accumulation.
A separate SAST export, run on 2026-04-12 against rabbitmq-server-backports, re-flagged the same finding under a different UID (e7b6c52475ff) at line 355. It is the same vulnerability in the same code path.
Preconditions
The rabbitmq_web_stomp plugin must be enabled. No authentication is required.
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N (6.3, Moderate). Fixed in 4.3.0, 4.2.6, 4.1.11, 4.0.20, 3.13.15.
Пакеты
rabbitmq
>= 4.2.0, < 4.2.6
4.2.6
rabbitmq
>= 4.1.0, < 4.1.11
4.1.11
rabbitmq
>= 4.0.0, < 4.0.20
4.0.20
rabbitmq
>= 3.13.0, < 3.13.15
3.13.15