Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Published: 2026-09-23
Score: 6 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply patch
AI Analysis

Impact

An authenticated stream client that can read any stream may trigger the broker to crash by supplying a malicious value for the "chunk_selector" property. The vulnerability arises from unfiltered use of binary_to_atom in get_chunk_selector/1, causing atom table exhaustion and loss of broker availability. The impact is a local denial of service that affects the entire RabbitMQ node but does not grant remote code execution or data compromise.

Affected Systems

RabbitMQ servers running any of the versions before 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1 with the rabbitmq_stream plugin enabled. Authenticated users with read access to at least one stream are required to be able to exploit the issue.

Risk and Exploitability

The CVSS score of 6 indicates moderate severity. No EPSS data is available, so the current likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers would need valid Stream protocol credentials and read permissions, but once satisfied they can cause the broker to terminate, impacting all clients connected to that node.

Generated by OpenCVE AI on September 23, 2026 at 21:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Replace the RabbitMQ server with the patched release (at least 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1) to remove the unchecked atom conversion.
  • Restart the broker cluster and ensure all nodes are running the corrected version.
  • If an immediate upgrade is not possible, revoke read permissions from stream clients or disable the rabbitmq_stream plugin until the patch is applied to prevent broker crashes.

Generated by OpenCVE AI on September 23, 2026 at 21:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Title RabbitMQ: Atom table exhaustion via stream `chunk_selector`
Weaknesses CWE-400
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-23T20:13:13.215Z

Reserved: 2026-07-23T23:25:28.897Z

Link: CVE-2026-66072

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-23T21:16:59.213

Modified: 2026-09-23T21:16:59.213

Link: CVE-2026-66072

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T21:30:07Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption