Atom Exhaustion Vulnerability in RabbitMQ Messaging Broker
CVE-2026-66071
What is CVE-2026-66071?
The RabbitMQ messaging broker, from versions 3.13.0 to 3.13.15 and 4.0.22, 4.1.11, 4.2.6, and 4.3.1, has a vulnerability related to atom exhaustion caused by the parsing of OAuth2 JWT tag scope values. While the token signature is verified to prevent forgery, in configurations where the scope content is user-influenced, each login with a novel tag can lead to the leakage of information. Specifically, signed tokens allowing attacker-influenced scope values may pose a risk in deployments utilizing IdPs with RabbitMQ’s OAuth2 backend. This vulnerability has been addressed in the subsequent versions.
Affected Version(s)
rabbitmq-server >= 3.13.0, < 3.13.15 < 3.13.0, 3.13.15
rabbitmq-server >= 4.0.0, < 4.0.22 < 4.0.0, 4.0.22
rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11