An inefficient regular expression vulnerability in RabbitMQ allows authenticated users to trigger a denial of service by exhausting server CPU resources.

The application fails to apply match limits when processing user-supplied regular expressions within the list API endpoints. An attacker with the management tag can provide complex regex patterns that, when executed against a large set of resources, cause significant CPU saturation and scheduler blocking.

Successful exploitation results in a denial of service condition that can impact the availability of the messaging infrastructure. While the CVSS score is 6.0, the potential for total scheduler saturation and resulting service downtime poses a significant risk to applications relying on RabbitMQ for critical message queuing and streaming operations.

Immediate Action: Upgrade to RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 to implement the necessary regex execution limits.

Proactive Monitoring: Monitor server CPU utilization and API request latency for spikes, particularly those associated with management tag users accessing list endpoints.

Compensating Controls: Restrict access to the management interface to trusted users only, as the vulnerability requires the management tag to exploit.

Public Exploit Available: exploit_available (unknown)

Given the potential for service degradation, administrators should prioritize updating RabbitMQ instances to the fixed versions listed above. Organizations should also audit their management console permissions to ensure only authorized personnel hold the management tag, thereby reducing the attack surface for this denial of service vulnerability.