Atom Table Exhaustion Vulnerability in RabbitMQ Messaging Broker
CVE-2026-66073
6MEDIUM
What is CVE-2026-66073?
A vulnerability exists in RabbitMQ that allows exploitation via the management API's node field. The defect permits a user with management privileges to create unique values in the node JSON field, leading to an irreversible leak of atoms which can subsequently exhaust system resources, crashing the virtual machine. This would affect all tenants using the affected version. There have been fixes implemented in versions 3.13.15 and 4.0.20, as well as 4.1.11 and 4.2.6, which include improvements to the handling of atom names and management calls.
Affected Version(s)
rabbitmq-server >= 3.13.0, < 3.13.15 < 3.13.0, 3.13.15
rabbitmq-server >= 4.0.0, < 4.0.20 < 4.0.0, 4.0.20
rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11