RabbitMQ Messaging Broker Atom Exhaustion Vulnerability
CVE-2026-67227

5.9MEDIUM

Key Information:

Vendor

RabbitMQ

Status
RabbitMQ-server
Vendor
CVE Published:
25 September 2026

What is CVE-2026-67227?

The vulnerability in RabbitMQ allows a user with the 'policymaker' tag to conduct an atom exhaustion attack by exploiting various API endpoints. This issue arises when the system's atom table is exhausted through repetitive requests to the /api/global-parameters/:name URL, thereby crashing the service. The vulnerable versions range from 4.0.0 to 4.3.1, requiring users to upgrade to the fixed versions to ensure application stability and resilience against such attacks.

Affected Version(s)

rabbitmq-server >= 4.0.0, < 4.0.22 < 4.0.0, 4.0.22

rabbitmq-server >= 4.1.0, < 4.1.14 < 4.1.0, 4.1.14

rabbitmq-server >= 4.2.0, < 4.2.7 < 4.2.0, 4.2.7

References

https://github.com/rabbitmq/rabbitmq-server/security/advi...
x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/commit/8fbe6d...
x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/commit/fc591e...
x_refsource_MISC

CVSS V4

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.