Erlang Atom DoS Vulnerability in RabbitMQ Messaging Broker
CVE-2026-67415
What is CVE-2026-67415?
This vulnerability in RabbitMQ's Shovel parameter parser allows an attacker to convert uncontrolled runtime parameter values into non-garbage-collected Erlang atoms. This leads to the exhaustion of the node-wide atom table, potentially resulting in denial of service. Exploitation necessitates network access to the Management HTTP API, valid credentials with both the management and policymaker tags, and the ability to set Shovel runtime parameters on a virtual host. Additionally, it requires the enabled rabbitmq_shovel and rabbitmq_shovel_management plugins. Malicious parameters can be stored durably and affect system performance even after a restart, making remediation critical. Versions 4.2.9 and 4.3.3 address this issue.
Affected Version(s)
rabbitmq-server >= 4.3.0, < 4.3.3 < 4.3.0, 4.3.3
rabbitmq-server >= 4.2.0, < 4.2.9 < 4.2.0, 4.2.9