CVE-2026-66072 - Vulnerability Details

- RabbitMQ: Atom table exhaustion via stream `chunk_selector`

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.

Published: 2026-09-23

Score: 6 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An authenticated stream client that can read any stream may trigger the broker to crash by supplying a malicious value for the "chunk_selector" property. The vulnerability arises from unfiltered use of binary_to_atom in get_chunk_selector/1, causing atom table exhaustion and loss of broker availability. The impact is a local denial of service that affects the entire RabbitMQ node but does not grant remote code execution or data compromise.

Affected Systems

RabbitMQ servers running any of the versions before 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1 with the rabbitmq_stream plugin enabled. Authenticated stream-protocol users with read access to at least one stream are required to be able to exploit the issue.

Risk and Exploitability

The CVSS score of 6 indicates moderate severity. No EPSS data is available, so the current likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers would need valid Stream protocol credentials and read permissions, but once satisfied they can cause the broker to terminate, impacting all clients connected to that node.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

rabbitmq

rabbitmq-server

affected

Version	Status	Constraints
`>= 3.13.0, < 3.13.15`	affected	—
`>= 4.0.0, < 4.0.20`	affected	—
`>= 4.1.0, < 4.1.11`	affected	—
`>= 4.2.0, < 4.2.6`	affected	—
`>= 4.3.0, < 4.3.1`	affected	—

No data.

Vendor Product Confidence Versions

Rabbitmq

Rabbitmq-server

100%

Version	Status	Scheme	Platform
`[3.13.0,3.13.15)`	affected	semver	—
`[4.0.0,4.0.20)`	affected	semver	—
`[4.1.0,4.1.11)`	affected	semver	—
`[4.2.0,4.2.6)`	affected	semver	—
`[4.3.0,4.3.1)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Replace the RabbitMQ server with the patched release (at least 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1) to remove the unchecked atom conversion.
Restart the broker cluster and ensure all nodes are running the corrected version.
If an immediate upgrade is not possible, revoke read permissions from stream clients or disable the rabbitmq_stream plugin until the patch is applied to prevent broker crashes.

Generated by OpenCVE AI on September 24, 2026 at 01:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0033.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-48hm-chgv-398r
https://nvd.nist.gov/vuln/detail/CVE-2026-66072
https://www.cve.org/CVERecord?id=CVE-2026-66072

History

Thu, 24 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 24 Sep 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-770
References		https://nvd.nist.gov/vuln/detail/CVE-2026-66072 https://www.cve.org/CVERecord?id=CVE-2026-66072
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 23 Sep 2026 22:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Rabbitmq Rabbitmq rabbitmq-server
Vendors & Products		Rabbitmq Rabbitmq rabbitmq-server

Wed, 23 Sep 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description		RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Title		RabbitMQ: Atom table exhaustion via stream `chunk_selector`
Weaknesses		CWE-400
References		https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6 https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1 https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-48hm-chgv-398r
Metrics		cvssV4_0 `{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Rabbitmq Rabbitmq-server

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-09-23T20:13:13.215Z

Updated: 2026-09-24T14:27:29.171Z

Reserved: 2026-07-23T23:25:28.897Z

Link: CVE-2026-66072

Vulnrichment

Updated: 2026-09-24T14:27:19.661Z

NVD

Status : Awaiting Analysis

Published: 2026-09-23T21:16:59.213

Modified: 2026-09-24T15:17:28.377

Link: CVE-2026-66072

Redhat

Severity : Moderate

Publid Date: 2026-09-23T20:13:13Z

Links: CVE-2026-66072 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-24T02:00:14Z

Weaknesses

CWE-400
Uncontrolled Resource Consumption
CWE-770
Allocation of Resources Without Limits or Throttling

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object