CVE-2026-67226
RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits ~3-4M short tag strings. An administrator can crash the node in a single request by creating a user (or importing definitions) with ~1M unique tag administrator. This issue is fixed in versions 4.0.22 and 4.1.14 and 4.2.7.
| CWE | CWE-400 |
| Vendor | rabbitmq |
| Product | rabbitmq-server |
| Published | Sep 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for rabbitmq rabbitmq-server
Be the first to know when new unknown vulnerabilities affecting rabbitmq rabbitmq-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
rabbitmq / rabbitmq-server
>= 4.0.0, < 4.0.22 >= 4.1.0, < 4.1.14 >= 4.2.0, < 4.2.7