Vulnerability in RabbitMQ Messaging Broker Can Cause Node Crash for Admin Users
CVE-2026-67229
6.9MEDIUM
What is CVE-2026-67229?
A vulnerability in RabbitMQ allows an administrator to crash a node by importing a specially crafted definitions file that contains an excessive number of unique metadata keys. This issue arises when the add_vhost/2 function executes rabbit_data_coercion:atomize_keys/1, using the unsafe binary_to_atom operation. Specifically, if an admin attempts to import a vhost entry with approximately 1 million unique keys, the atom table is exhausted, leading to node failure. For remediation, users are advised to update RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0.
Affected Version(s)
rabbitmq-server >= 3.13.0, < 3.13.15 < 3.13.0, 3.13.15
rabbitmq-server >= 4.0.0, < 4.0.20 < 4.0.0, 4.0.20
rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11