The vulnerability arises when RabbitMQ's runtime-parameter lookup path coerces the :component segment of a request URL into an Erlang atom by calling rabbit_data_coercion:to_atom/1. Every distinct component value that has not been seen before creates a new atom entry, and because Erlang atoms are permanently stored in a bounded table, an attacker who can supply a large number of unique component names can exhaust that table and trigger a node crash, resulting in a denial of service.

Affected systems are installations of RabbitMQ Server running a version earlier than 4.2.7 or 4.3.1. The issue is present in the rabbitmq:rabbitmq-server product and has been addressed in the 4.2.7 and 4.3.1 releases. Administrators of these deployments should verify their current version and apply the appropriate update.

The CVSS base score of 6.9 indicates moderate severity. Exploitation requires the ability to act as a policymaker and the ability to issue roughly one million distinct component requests, which limits the threat to privileged users on the internal network. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, so the likelihood of widespread exploitation is low, but when an attacker succeeds the impact is a complete shut-down of the node and a loss of service for all clients.