VMware RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5 Regex Execution match_value Name incorrect bitwise shift of integer

Summaryinfo

A vulnerability, which was classified as problematic, has been found in VMware RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5. This affects the function match_value of the component Regex Execution. The manipulation of the argument Name leads to incorrect bitwise shift of integer. This vulnerability is referenced as CVE-2026-66074. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in VMware RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5 and classified as problematic. This issue affects the function match_value of the component Regex Execution. The manipulation of the argument name with an unknown input leads to a incorrect bitwise shift of integer vulnerability. Using CWE to declare the problem leads to CWE-1335. An integer value is specified to be shifted by a negative amount or an amount greater than or equal to the number of bits contained in the value causing an unexpected or indeterminate result. Impacted is availability. The summary by CVE is:

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, match_value/3 passes the user-supplied ?name= regular expression to re:run with no match_limit option, and executes it once per resource in the result set. OTP's default 10M match_limit caps each call at roughly 100-200ms, but the regex runs once per resource in the result set. With a large set, for example 5000 queues at 150ms each, a single request consumes 12 or more minutes of CPU. Parallel requests saturate the schedulers. The use_regex=true option is a supported feature on list endpoints, so this path is reachable through normal API use. Preconditions include Any user with the management tag can exploit this.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-66074 since 07/24/2026. The exploitation is known to be easy. The attack may be initiated remotely. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 3.13.15, 4.0.20, 4.1.11, 4.2.6 or 4.3.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• VMware

Name

• RabbitMQ

Version

• 3.13.0
• 3.13.1
• 3.13.2
• 3.13.3
• 3.13.4
• 3.13.5
• 3.13.6
• 3.13.7
• 3.13.8
• 3.13.9
• 3.13.10
• 3.13.11
• 3.13.12
• 3.13.13
• 3.13.14
• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.0.10
• 4.0.11
• 4.0.12
• 4.0.13
• 4.0.14
• 4.0.15
• 4.0.16
• 4.0.17
• 4.0.18
• 4.0.19
• 4.1.0
• 4.1.1
• 4.1.2
• 4.1.3
• 4.1.4
• 4.1.5
• 4.1.6
• 4.1.7
• 4.1.8
• 4.1.9
• 4.1.10
• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion