Denial of Service Vulnerability in RabbitMQ Messaging Broker
CVE-2026-67228
6.9MEDIUM
What is CVE-2026-67228?
RabbitMQ, a widely used messaging and streaming broker, has a vulnerability where the runtime-parameters lookup path improperly coerces the :component segment of request URLs into a new atom, which can lead to a denial of service. An attacker with policymaker privileges can exploit this vulnerability by issuing a high volume of distinct requests, exhausting the bounded Erlang atom table and causing the server node to crash. This issue is resolved in versions 4.2.7 and 4.3.1, where a safer method of handling atom creation is implemented to prevent such exhaustions.
Affected Version(s)
rabbitmq-server >= 4.2.0, < 4.2.7 < 4.2.0, 4.2.7
rabbitmq-server >= 4.3.0, < 4.3.1 < 4.3.0, 4.3.1