Description
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name / routing key beginning amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). binary_to_existing_atom is not used. Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests. Preconditions include Authenticated AMQP 0-9-1 connection to any vhost No per-connection rate limit low enough to make ~1M operations infeasible. This issue is fixed in versions 4.2.7 and 4.3.1.
Published: 2026-09-23
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via Erlang VM crash
Action: Patch
AI Analysis

Impact

A flaw in RabbitMQ’s message broker allows a client to trigger the creation of overly many atoms from an external type format binary. The incorrect atom creation is not cleaned up by the Erlang garbage collector, quickly exhausting the atom table and causing the entire VM to crash. This denial of service disables all vhosts and connections, severely impacting availability. The weakness is a classic resource exhaustion case (CWE-400) as well as an uncontrolled atom allocation scenario (CWE-770).

Affected Systems

The vulnerability affects RabbitMQ server versions prior to 4.2.7 and 4.3.1. Any authenticated AMQP client (the protocol version is inferred to be 0‑9‑1) can exploit the bug by connecting to any vhost.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity of the denial‑of‑service impact. No known exploits are publicly listed, but the EPSS score of <1% indicates a very low probability of exploitation and it is not in the CISA KEV catalog. The attack requires only authentication, with no per‑connection rate limits, and can be performed with roughly 1 M lightweight requests, making exploitation highly feasible for an attacker who can obtain valid credentials.

Generated by OpenCVE AI on September 26, 2026 at 05:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade RabbitMQ to version 4.2.7 or later 4.3.1, which contains the fix
  • Restrict or rate‑limit authenticated AMQP connections to prevent a single client from issuing the high volume of requests needed for the crash
  • Disable or proxy the internal reply‑to queue namespace (amq.rabbitmq.reply‑to.) so an external client cannot target the vulnerable decoding path

Generated by OpenCVE AI on September 26, 2026 at 05:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-770
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 25 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Rabbitmq
Rabbitmq rabbitmq-server
Vendors & Products Rabbitmq
Rabbitmq rabbitmq-server

Wed, 23 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name / routing key beginning amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). binary_to_existing_atom is not used. Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests. Preconditions include Authenticated AMQP 0-9-1 connection to any vhost No per-connection rate limit low enough to make ~1M operations infeasible. This issue is fixed in versions 4.2.7 and 4.3.1.
Title RabbitMQ: Atom-table exhaustion via reply-to queue name decoding
Weaknesses CWE-400
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Rabbitmq Rabbitmq-server
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-24T15:05:11.870Z

Reserved: 2026-07-28T19:50:39.438Z

Link: CVE-2026-67238

cve-icon Vulnrichment

Updated: 2026-09-24T13:58:59.775Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T20:17:13.297

Modified: 2026-09-24T16:17:09.780

Link: CVE-2026-67238

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-23T19:58:35Z

Links: CVE-2026-67238 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-26T06:00:06Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-770

    Allocation of Resources Without Limits or Throttling