A crafted vhost definition file containing more than one million unique short metadata keys can cause the RabbitMQ node to crash during import. The crash occurs because the server’s atomize_keys function converts these keys into atom values, exhausting the limited atom table and stomping the broker. The resulting denial of service prevents the management interface and message routing from operating until the node is restarted.

The vulnerability affects RabbitMQ Server versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. Only users holding the administrator tag can trigger the exploit by importing a malicious definitions file.

The CVSS score of 6.9 indicates a moderate severity. Exploitation requires administrator-level access, which limits the threat surface to environments where an attacker can gain or abuse administrative credentials or influence a trusted definition import. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so the overall risk is moderate but constrained by the admin-only precondition.