CVE-2026-67222

Analyzed Analyzed - Analysis Complete

Denial of Service in RabbitMQ via Atom Exhaustion

Publication date: 2026-09-25

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied list_to_atom/1 to every colon-delimited token in an attacker-controlled auth_mechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a large request. Exploitation requires the Shovel or Federation plugin to be in use, and setting auth_mechanism requires the policymaker tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67222

EUVD

EUVD-2026-87143

Affected Vendors & Products

Vendor	Product	Version / Range
broadcom	rabbitmq_server	From 3.13.0 (inc) to 3.13.15 (exc)
broadcom	rabbitmq_server	From 4.0.0 (inc) to 4.0.20 (exc)
broadcom	rabbitmq_server	From 4.1.0 (inc) to 4.1.11 (exc)
broadcom	rabbitmq_server	From 4.2.0 (inc) to 4.2.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects RabbitMQ versions between 3.13.0 and 3.13.15, 4.0.20, 4.1.11, and 4.2.6. It involves the mechanisms/1 function applying list_to_atom/1 to attacker-controlled auth_mechanism values, consuming Erlang VM atoms and crashing the node with large requests. Exploitation requires Shovel or Federation plugins and the policymaker tag.

Detection Guidance

This vulnerability requires specific conditions to be present: RabbitMQ versions between 3.13.0-3.13.14, 4.0.0-4.0.19, 4.1.0-4.1.10, or 4.2.0-4.2.5, with the Shovel or Federation plugin enabled and auth_mechanism configured via policymaker tag. Check RabbitMQ version with 'rabbitmqctl status' and plugin status with 'rabbitmq-plugins list'. Monitor for crashes or high memory usage in Erlang VM.

Impact Analysis

An attacker could crash your RabbitMQ node by sending a large request with a specially crafted auth_mechanism value. This would disrupt messaging services relying on RabbitMQ, potentially causing downtime or data loss if not mitigated.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA if exploited in systems handling personal or health data. The denial-of-service risk may violate availability requirements in these regulations. However, the specific impact depends on system configuration and data processing context.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, or 4.2.6 or later to address the vulnerability.

Hi! I’m here to help you understand CVE-2026-67222. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70