Description
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter :name. resourceexists/2 (and the PUT/DELETE handlers) call rabbitdatacoercion:toatom/1 on the :name URL path segment. toatom/1 uses binarytoatom/2 (unsafe). The endpoint requires policymaker (not management, but below A user with the policymaker tag can crash the node by exhausting the atom table via repeated requests to /api/global-parameters/:name with unique :name Management plugin enabled policymaker tag ~1M HTTP. This issue is fixed in versions 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1.
Published: 2026-09-25
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service by atom table exhaustion
Action: Upgrade
AI Analysis

Impact

The vulnerability allows a user with the policymaker role to crash a RabbitMQ node by exhausting the atom table. Repeated HTTP requests to the endpoint /api/global-parameters/:name with a unique :name value cause RabbitMQ to convert each name to an atom using an unsafe binary conversion function. As the atom table is finite, a large number of unique names fills the table, leading the JVM to fail and the broker to terminate. This results in a denial of service for all clients connected to the broker.

Affected Systems

RabbitMQ server versions 4.0.0 through 4.0.21, 4.1.0 through 4.1.13, 4.2.0 through 4.2.6, and 4.3.0 are affected. The issue is fixed in version 4.0.22 and in all later releases 4.1.14, 4.2.7, and 4.3.1.

Risk and Exploitability

The CVSS score of 5.9 indicates a moderate severity, and the EPSS score is not published, with no listing in the CISA KEV catalog. Exploitation requires an account with the policymaker tag and involves sending a high volume of HTTP requests to the API endpoint from an external network. The resulting crash creates a service outage that impacts all producers and consumers relying on the compromised RabbitMQ instance.

Generated by OpenCVE AI on September 25, 2026 at 17:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade RabbitMQ to at least version 4.0.22 or any later release that contains the fix.
  • Restrict assignment of the policymaker role to trusted administrators only, avoiding grant to general users.
  • Apply rate limiting or other flow‑control mechanisms on the /api/global-parameters endpoint to mitigate mass request attempts.

Generated by OpenCVE AI on September 25, 2026 at 17:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 26 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Rabbitmq
Rabbitmq rabbitmq-server
Vendors & Products Rabbitmq
Rabbitmq rabbitmq-server

Fri, 25 Sep 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter :name. resourceexists/2 (and the PUT/DELETE handlers) call rabbitdatacoercion:toatom/1 on the :name URL path segment. toatom/1 uses binarytoatom/2 (unsafe). The endpoint requires policymaker (not management, but below A user with the policymaker tag can crash the node by exhausting the atom table via repeated requests to /api/global-parameters/:name with unique :name Management plugin enabled policymaker tag ~1M HTTP. This issue is fixed in versions 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1.
Title RabbitMQ: Atom exhaustion: to_atom on global-parameter :name
Weaknesses CWE-400
References
Metrics cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Rabbitmq Rabbitmq-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-25T17:48:04.204Z

Reserved: 2026-07-28T19:50:39.437Z

Link: CVE-2026-67227

cve-icon Vulnrichment

Updated: 2026-09-25T17:47:58.430Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-25T17:17:11.417

Modified: 2026-09-28T14:38:38.163

Link: CVE-2026-67227

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T11:15:10Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption