CVE-2026-67228

Received Received - Intake

Denial of Service in RabbitMQ via Atom Table Exhaustion

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbit_data_coercion:to_atom/1 in lookup_component/1 (deps/rabbit/src/rabbit_runtime_parameters.erl), creating a new atom for any previously unseen value. A safe helper, rabbit_registry:binary_to_type/1, which uses binary_to_existing_atom with a catch, already exists but is not used at this call site. lookup_component/1 calls rabbit_data_coercion:to_atom(Component) on the :component segment of the request URL, converting an attacker-supplied string into a new atom. Because the Erlang atom table is bounded and atoms are never garbage collected, an authorized policymaker issuing roughly one million requests with distinct component values can exhaust the atom table and crash the node, resulting in a denial of service. Preconditions include Exploitation requires policymaker privileges and roughly one million requests.. This issue is fixed in versions 4.2.7 and 4.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-67228

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.2.7\|end_excluding=4.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ allows an authorized policymaker to crash the node by sending roughly one million requests with distinct component values in the URL. The issue occurs because the system converts these values into atoms without garbage collection, exhausting the atom table and causing a denial of service.

Detection Guidance

This vulnerability requires monitoring for excessive atom creation in RabbitMQ nodes. Check Erlang VM metrics for atom table usage with commands like 'erlang:memory(atom).' High atom count or rapid growth may indicate exploitation. Monitor logs for policymaker requests with distinct component values.

Impact Analysis

If you are a RabbitMQ user with policymaker privileges, an attacker could exploit this to crash your RabbitMQ node, disrupting messaging services and causing downtime. Non-privileged users cannot exploit this directly.

Compliance Impact

This vulnerability could lead to service disruptions, potentially violating availability requirements in GDPR or HIPAA. Downtime may impact data processing or access, affecting compliance with these regulations.

Mitigation Strategies

Upgrade RabbitMQ to versions 4.2.7 or 4.3.1 or later immediately. Restrict policymaker privileges to trusted users only. Implement rate limiting for API requests. Monitor atom table usage and set up alerts for abnormal growth.

Hi! I’m here to help you understand CVE-2026-67228. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70