A flaw in RabbitMQ’s handling of the auth_mechanism parameter allows an attacker to construct a value that is parsed into colon‑delimited tokens. Each token is passed through the Erlang function list_to_atom/1 which consumes a permanent atom. As atoms are a finite resource in the Erlang VM, an attacker can exhaust the pool and crash the RabbitMQ node. The vulnerability does not directly expose data or execute code; it primarily causes denial‑of‑service through resource exhaustion. The weakness is identified as CWE‑400, Excessive Resource Consumption.

RabbitMQ Server versions 3.13.0‑3.13.14 and all releases before 4.0.20, 4.1.11, and 4.2.6 are vulnerable. Versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6 contain the fix and are not affected.

The moderate CVSS score of 5.9 reflects the denial‑of‑service consequence but limited availability of exploitation. The EPSS value is not available, and the vulnerability is not listed in CISA’s KEV catalogue. Exploitation requires the Shovel or Federation plugin to be enabled and the attacker must be able to set auth_mechanism, a capability normally restricted to users with the policymaker role. Because of these prerequisites the threat is scoped to administrators or compromised accounts that can create custom policies; remote attackers without such privileges cannot exploit it. The likely attack vector is within the management plane of a RabbitMQ cluster, where a privileged user or a compromised management token could upload a malicious policy.