CVE-2026-66071

Undergoing Analysis Undergoing Analysis - In Progress

Atom Exhaustion via OAuth2 JWT Scope in RabbitMQ

Publication date: 2026-09-25

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom() to convert to a tag atom. The token signature is verified first, so the attacker cannot forge scopes , but in IdP configurations where scope content is user-influenced, each login with a novel tag value leaks one In deployments where users can influence the scopes included in their IdP-issued JWT rabbitmqauthbackendoauth2 enabled IdP permits attacker-influenced scope values in signed tokens. This issue is fixed in versions 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-66071

EUVD

EUVD-2026-87151

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	rabbitmq_server	From 3.13.0 (inc) to 3.13.15 (exc)
broadcom	rabbitmq_server	From 4.1.0 (inc) to 4.1.11 (exc)
broadcom	rabbitmq_server	From 4.2.0 (inc) to 4.2.6 (exc)
broadcom	rabbitmq_server	From 4.0.0 (inc) to 4.0.22 (exc)
broadcom	rabbitmq_server	From 4.3.0 (inc) to 4.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ involves an atom exhaustion issue in the OAuth2 JWT scope parsing mechanism. When scope values contain tags like .tag:, the system converts them to atoms using rabbitdatacoercion:toatom(). Each unique tag value leaks memory, and in configurations where users can influence scope content, repeated logins with novel tags can exhaust available atoms.

Detection Guidance

This vulnerability can be detected by checking the RabbitMQ version against the affected releases (3.13.0 to 3.13.15, 4.0.22, 4.1.11, 4.2.6, 4.3.1). Use commands like 'rabbitmqctl status' or 'rabbitmq-diagnostics status' to verify the version. If using OAuth2 with rabbitmqauthbackendoauth2, inspect JWT scope handling for atom exhaustion risks.

Impact Analysis

If you use RabbitMQ with OAuth2 authentication and user-influenced scopes, an attacker could exploit this to cause a denial of service by exhausting system resources. This could lead to service degradation or crashes in RabbitMQ instances.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized data exposure through atom exhaustion in OAuth2 JWT scope parsing. If user-influenced scope values leak sensitive information, it may violate data protection principles under GDPR (e.g., Article 5) and HIPAA's integrity and confidentiality requirements.

Mitigation Strategies

Upgrade RabbitMQ to a patched version: 3.13.15 or later, 4.0.22 or later, 4.1.11 or later, 4.2.6 or later, or 4.3.1 or later. Disable OAuth2 JWT authentication if user-influenced scopes are present.

Hi! I’m here to help you understand CVE-2026-66071. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70