CVE-2026-67229

Received Received - Intake

Denial of Service in RabbitMQ via Metadata Atom Table Exhaustion

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_vhost/2 calls rabbit_data_coercion:atomize_keys/1 (the unsafe variant using binary_to_atom) on the vhost metadata map. The 20 MB management body limit fits ~1M+ short keys. Admin-only. An administrator importing a crafted definitions file can crash the node in a single request: a vhosts entry with ~1M unique metadata keys exhausts the atom table during import. Preconditions include administrator tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-67229

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 3.13.15\|end_excluding=4.0.20\|end_excluding=4.1.11\|end_excluding=4.2.6\|end_excluding=4.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

RabbitMQ versions before 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 have a flaw in the add_vhost/2 function. It uses an unsafe method to process vhost metadata, converting keys to atoms without proper limits. An attacker with admin privileges could exploit this by importing a crafted definitions file with around 1 million unique metadata keys, causing the node to crash by exhausting the atom table.

Detection Guidance

This vulnerability is triggered by a crafted definitions file with ~1M unique metadata keys in the vhosts entry. Detection requires checking for unusually large metadata files or atom table exhaustion in RabbitMQ logs. Monitor for crashes during vhost imports or high memory usage in the management plugin.

Impact Analysis

If you are an administrator using an affected RabbitMQ version, an attacker with admin access could crash your RabbitMQ node with a single malicious request. This leads to service disruption, potential data loss, and downtime for messaging or streaming services relying on RabbitMQ.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 or later. Restrict admin access to prevent malicious definitions file imports. Monitor for suspicious vhost import attempts and enforce strict size limits on metadata.

Hi! I’m here to help you understand CVE-2026-67229. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70