Description
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom() to convert to a tag atom. The token signature is verified first, so the attacker cannot forge scopes , but in IdP configurations where scope content is user-influenced, each login with a novel tag value leaks one In deployments where users can influence the scopes included in their IdP-issued JWT rabbitmqauthbackendoauth2 enabled IdP permits attacker-influenced scope values in signed tokens. This issue is fixed in versions 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1.
Published: 2026-09-25
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Resource Exhaustion (Denial of Service)
Action: Patch
AI Analysis

Impact

An attacker can influence the contents of OAuth2 JWT scopes that contain a ".tag:" prefix. When RabbitMQ parses these scopes, it converts each unique tag value into an Erlang atom. Because atoms are stored in a finite table that grows with each new untrusted value, a high volume of distinct tags can fill the table and exhaust system memory, causing the broker to crash or become unresponsive. This results in a denial‑of‑service attack. The weaknesses are identified as CWE‑400 and CWE‑770.

Affected Systems

RabbitMQ Server versions 3.13.0 through 3.13.14, 4.0.0 through 4.0.21, 4.1.0 through 4.1.10, 4.2.0 through 4.2.5, and 4.3.0 are affected. The problem is triggered when the rabbitmqauthbackendoauth2 backend is enabled and the IdP permits user‑controlled scope values in signed JWTs. All clients connected to the compromised broker can experience service disruption.

Risk and Exploitability

The CVSS score of 6 denotes medium severity. The EPSS score of 0.00342 indicates a very low probability of exploitation, with no public exploits reported yet. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to supply a signed JWT with novel ".tag:" scope values, which requires an IdP that allows such content.

Generated by OpenCVE AI on October 3, 2026 at 01:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade rabbitmq-server to any fixed release such as 3.13.15, 4.0.22, 4.1.11, 4.2.6, 4.3.1 or later.
  • If an upgrade is not immediately possible, disable the rabbitmqauthbackendoauth2 backend or reconfigure the IdP to reject or normalise user‑controlled scope values in JWTs.
  • Consider implementing monitoring or limits on atom table usage and overall memory consumption to detect and mitigate rapid exhaustion before a crash occurs.

Generated by OpenCVE AI on October 3, 2026 at 01:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Broadcom
Broadcom rabbitmq Server
CPEs cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
Vendors & Products Broadcom
Broadcom rabbitmq Server
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Sat, 03 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Sat, 26 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
First Time appeared Rabbitmq
Rabbitmq rabbitmq-server
Vendors & Products Rabbitmq
Rabbitmq rabbitmq-server

Fri, 25 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom() to convert to a tag atom. The token signature is verified first, so the attacker cannot forge scopes , but in IdP configurations where scope content is user-influenced, each login with a novel tag value leaks one In deployments where users can influence the scopes included in their IdP-issued JWT rabbitmqauthbackendoauth2 enabled IdP permits attacker-influenced scope values in signed tokens. This issue is fixed in versions 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1.
Title RabbitMQ: Atom exhaustion: OAuth2 JWT tag: scope values
Weaknesses CWE-400
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Broadcom Rabbitmq Server
Rabbitmq Rabbitmq-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-25T17:53:13.500Z

Reserved: 2026-07-23T23:25:28.897Z

Link: CVE-2026-66071

cve-icon Vulnrichment

Updated: 2026-09-25T17:53:09.583Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-25T17:17:09.987

Modified: 2026-10-15T20:14:57.567

Link: CVE-2026-66071

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-25T16:11:07Z

Links: CVE-2026-66071 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-03T02:00:22Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling