CVE-2026-66080

MediumCVSS 4.9/10Last modified Oct 19, 2026

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.11, 4.2.6, and 4.3.0, validate_partitions only checks that the requested partition count is at least 1, with no upper bound. A large count such as lists:seq(0, 500000000) allocates roughly 8GB. Preconditions include The rabbitmq_stream_management plugin must be enabled. The caller needs the management tag and access to the target vhost.. This issue is fixed in versions 4.1.11, 4.2.6, and 4.3.0.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2026
Last modified
Oct 19, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-660818.7Access of Uninitialized Pointer vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. UsersCVE-2026-660826.5An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow sCVE-2026-660836.5The /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoCVE-2026-660848.1An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are CVE-2026-660855.5In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local infCVE-2026-660869.8In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messageCVE-2026-660878.1An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are noCVE-2026-66096.3A flaw has been found in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function form_valid of the file oauth/views.py. CVE-2026-660986.5The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot intoCVE-2026-66103.7A vulnerability has been found in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file djangoblog/CVE-2026-661098.5A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker whCVE-2026-66113.1A vulnerability was found in liangliangyy DjangoBlog up to 2.1.0.0. This affects an unknown function of the file djangoblog/settings.py of t