A vulnerability in the RabbitMQ messaging broker allows authenticated users to trigger a denial of service by crashing the broker node.

The flaw exists in the get_chunk_selector/1 function, which improperly processes raw client-supplied input using binary_to_atom without necessary validation. This requires an authenticated stream-protocol user with read access to at least one stream and the rabbitmq_stream plugin enabled to exploit.

Successful exploitation results in a complete denial of service for the messaging broker, which can disrupt critical downstream application communication and data processing. While the CVSS score of 6.0 reflects a medium severity due to the requirement for authentication, the resulting availability impact on messaging infrastructure can cause significant operational downtime.

Immediate Action: Upgrade rabbitmq-server to version 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.1, or later to incorporate the necessary input validation guard.

Proactive Monitoring: Audit access logs for authenticated users performing unusual stream subscription patterns and monitor node health metrics for unexpected process crashes or restarts.

Compensating Controls: Restrict access to the stream protocol to trusted users only and ensure that the rabbitmq_stream plugin is disabled if it is not strictly required for business operations.

Public Exploit Available: No

Given the potential for service disruption, administrators should prioritize patching RabbitMQ instances in production environments. Ensure that stream-protocol access is audited and restricted to the minimum necessary user base to mitigate the risk of unauthorized or malicious exploitation.