Description
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name / routing key beginning amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). binary_to_existing_atom is not used. Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests. Preconditions include Authenticated AMQP 0-9-1 connection to any vhost No per-connection rate limit low enough to make ~1M operations infeasible. This issue is fixed in versions 4.2.7 and 4.3.1.
Published: 2026-09-23
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: Denial of Service via Erlang VM crash
Action: Patch
AI Analysis

Impact

A flaw in RabbitMQ’s message broker allows a client to trigger the creation of overly many atoms from an external type format binary. The incorrect atom creation is not cleaned up by the Erlang garbage collector, quickly exhausting the atom table and causing the entire VM to crash. This denial of service disables all vhosts and connections, severely impacting availability. The weakness is a classic resource exhaustion case (CWE‑400).

Affected Systems

The vulnerability affects RabbitMQ server versions prior to 4.2.7 and 4.3.1. Any authenticated AMQP 0‑9‑1 client connecting to any vhost can exploit the bug.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity of the denial-of-service impact. No known exploits are publicly listed, but the EPSS score is unavailable and it is not in the CISA KEV catalog. The attack requires only authentication, with no per-connection rate limits, and can be performed with roughly 1 M lightweight requests, making exploitation highly feasible for an attacker who can obtain valid credentials.

Generated by OpenCVE AI on September 23, 2026 at 21:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade RabbitMQ to version 4.2.7 or later 4.3.1, which contains the fix
  • Restrict or rate-limit authenticated AMQP connections to prevent a single client from issuing the high volume of requests needed for the crash
  • Disable or proxy the internal reply‑to queue namespace (amq.rabbitmq.reply‑to.) so an external client cannot target the vulnerable decoding path

Generated by OpenCVE AI on September 23, 2026 at 21:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name / routing key beginning amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). binary_to_existing_atom is not used. Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests. Preconditions include Authenticated AMQP 0-9-1 connection to any vhost No per-connection rate limit low enough to make ~1M operations infeasible. This issue is fixed in versions 4.2.7 and 4.3.1.
Title RabbitMQ: Atom-table exhaustion via reply-to queue name decoding
Weaknesses CWE-400
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-23T19:58:35.019Z

Reserved: 2026-07-28T19:50:39.438Z

Link: CVE-2026-67238

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-23T20:17:13.297

Modified: 2026-09-23T20:17:13.297

Link: CVE-2026-67238

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T21:30:07Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption