A vulnerability in RabbitMQ allows authenticated users to bypass connection limits and exhaust resources, potentially leading to a denial of service for other tenants.

This is an resource management flaw (CWE-770) where the stream open handler neglects to perform necessary node, virtual host, or user connection-limit checks. The vulnerability is triggered by an authenticated tenant connecting via the stream protocol port 5552, effectively circumventing the security controls applied to standard AMQP connections.

The inability to enforce tenant isolation through connection caps threatens the stability of shared messaging infrastructure. An attacker can monopolize system resources, leading to service degradation or total outage for legitimate users sharing the same broker. While the CVSS score of 6.0 reflects a medium severity, the impact on availability in multi-tenant environments justifies prioritized remediation.

Immediate Action: Upgrade the RabbitMQ server to version 4.2.7 or 4.3.1, which include the necessary enforcement logic for connection limits.

Proactive Monitoring: Review connection logs for unusual spikes in activity originating from the stream protocol port 5552 and monitor broker resource utilization metrics for signs of intentional exhaustion.

Compensating Controls: If immediate patching is not feasible, consider restricting network access to port 5552 or disabling the rabbitmq_stream plugin if it is not strictly required for business operations.

Public Exploit Available: No (exploit_available: unknown)

Organizations relying on RabbitMQ for multi-tenant isolation must treat this vulnerability with urgency. By bypassing configured connection limits, an attacker can disrupt messaging services for other users. Administrators should prioritize the application of the vendor-provided patches to restore proper resource throttling and ensure consistent tenant isolation.