Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Impact
The frame size limit negotiated during the stream-protocol handshake is never enforced against the declared length of inbound frames. A client can send a frame whose declared size exceeds the negotiated frame_max, and the broker buffers the frame data before any size check is applied. This produces memory pressure on the node and a potential denial of service. The condition is reachable before authentication over the network.
Description
The stream protocol negotiates a maximum frame size (FrameMax) during the Tune handshake. The negotiated value is stored but never applied to incoming frames. A %% TODO: check max frame size comment in rabbit_stream_core (deps/rabbitmq_stream_common/src/rabbit_stream_core.erl) confirmed the gap: the 4-byte frame size header is read and the frame is buffered without comparing the declared length against frame_max.
Preconditions
The stream plugin must be enabled.
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N (6.3, Moderate). Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0.
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Impact
The frame size limit negotiated during the stream-protocol handshake is never enforced against the declared length of inbound frames. A client can send a frame whose declared size exceeds the negotiated
frame_max, and the broker buffers the frame data before any size check is applied. This produces memory pressure on the node and a potential denial of service. The condition is reachable before authentication over the network.Description
The stream protocol negotiates a maximum frame size (
FrameMax) during the Tune handshake. The negotiated value is stored but never applied to incoming frames. A%% TODO: check max frame sizecomment inrabbit_stream_core(deps/rabbitmq_stream_common/src/rabbit_stream_core.erl) confirmed the gap: the 4-byte frame size header is read and the frame is buffered without comparing the declared length againstframe_max.Preconditions
The stream plugin must be enabled.
CVSS
CVSS v4.0:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N(6.3, Moderate). Fixed in3.13.15,4.0.20,4.1.11,4.2.6,4.3.0.