Messaging Broker Vulnerability in RabbitMQ by Pivotal Software
CVE-2026-67238
What is CVE-2026-67238?
RabbitMQ, a widely used messaging and streaming broker, is prone to a vulnerability that allows authenticated AMQP clients to exploit improper binary parsing. Before versions 4.2.7 and 4.3.1, a flaw exists in the handling of ETF-encoded binaries during the processing of node names. This results in the potential for crashing the Erlang Virtual Machine (VM) due to memory allocation issues, as the system creates non-garbage-collected atoms from attacker-controlled input. As a result, an authenticated user can crash the entire VM across all vhosts and connections with approximately one million requests, creating a severe denial of service risk. This vulnerability underscores the importance of maintaining updated software to safeguard against disruptions.
Affected Version(s)
rabbitmq-server >= 4.2.0, < 4.2.7 < 4.2.0, 4.2.7
rabbitmq-server >= 4.3.0, < 4.3.1 < 4.3.0, 4.3.1