CVE-2026-67415

Undergoing Analysis Undergoing Analysis - In Progress

Atomic Table Exhaustion in RabbitMQ Shovel Plugin

Publication date: 2026-09-25

Last updated on: 2026-09-28

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking a fixed allowlist. Exploitation requires network access to the Management HTTP API, valid credentials with both the management and policymaker tags, permission to set Shovel runtime parameters on a vhost, and the rabbitmq_shovel and rabbitmq_shovel_management plugins to be enabled. The attacker can exhaust the node-wide atom table and deny service, and malicious parameters are stored durably and reparsed when workers start, so atom pressure can recur after restart without a live attacker connection. This issue is fixed in versions 4.2.9 and 4.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-28

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-67415

EUVD

EUVD-2026-87225

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	From 4.2.0 (inc) to 4.2.9 (inc)
rabbitmq	rabbitmq	to 4.3.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

RabbitMQ versions 4.2.0 to 4.2.9 and 4.3.3 have a flaw where the Shovel parameter parser converts attacker-controlled runtime parameter values into Erlang atoms without proper bounds checking or allowlist validation. This can lead to atom table exhaustion and denial of service.

Detection Guidance

Detecting this vulnerability requires checking RabbitMQ versions and monitoring atom table usage. Verify if your RabbitMQ version is between 4.2.0 and 4.2.9 or 4.3.0 and 4.3.2. Check the Management HTTP API for unusual Shovel parameter configurations or excessive atom usage. Commands include: rabbitmqctl status to check version, rabbitmqctl eval 'erlang:system_info(atom_count).' to monitor atom table size, and reviewing logs for Shovel-related errors.

Impact Analysis

An attacker with network access to the Management HTTP API, valid credentials, and permission to set Shovel runtime parameters could exhaust the node-wide atom table, causing service denial. The issue persists after restart due to durable storage of malicious parameters.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by enabling denial-of-service attacks that disrupt messaging services, which may affect data availability and integrity. However, the provided CVE details do not explicitly link this issue to specific compliance violations or regulatory requirements.

Mitigation Strategies

Upgrade RabbitMQ to version 4.2.9 or 4.3.3 or later immediately. Disable the rabbitmq_shovel and rabbitmq_shovel_management plugins if not needed. Restrict access to the Management HTTP API by limiting network exposure and enforcing strong authentication. Review and remove any unauthorized Shovel configurations from the vhost.

Hi! I’m here to help you understand CVE-2026-67415. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70