RabbitMQ Server versions from 4.0.0 up to 4.0.22, 4.1.14, and 4.2.7 allow an administrator to trigger atom exhaustion by sending a single PUT request to the /api/users endpoint with an excessively long list of user tags. The server maps the tags to atoms without adequate validation, which exhausts atom memory and crashes the node, causing a denial of service for all connected clients.

The vulnerability affects the RabbitMQ Server application. Administrators with access to the management API (PUT /api/users) on versions 4.0.0‑4.0.22, 4.1.14, and 4.2.7 are at risk. The fix is included in v4.0.22 and later releases, including 4.1.14 and 4.2.7.

The CVSS base score of 6.9 indicates moderate severity, and the missing EPSS score does not change the assessment that the flaw can be readily exploited in environments where an attacker has administrative API privileges. Because the flaw requires only a single request with a large tag list, it is trivially reproducible for an authenticated admin and is not listed in CISA’s KEV catalog. The primary attack vector is via the administrative REST API, so the risk is limited to environments with exposed or misconfigured admin access.