CVE-2026-67227
RabbitMQ: Atom exhaustion: to_atom on global-parameter :name
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter :name. resourceexists/2 (and the PUT/DELETE handlers) call rabbitdatacoercion:toatom/1 on the :name URL path segment. toatom/1 uses binarytoatom/2 (unsafe). The endpoint requires policymaker (not management, but below A user with the policymaker tag can crash the node by exhausting the atom table via repeated requests to /api/global-parameters/:name with unique :name Management plugin enabled policymaker tag ~1M HTTP. This issue is fixed in versions 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1.
| CWE | CWE-400 |
| Vendor | rabbitmq |
| Product | rabbitmq-server |
| Published | Sep 25, 2026 |
| Last Updated | Sep 25, 2026 |
Get instant alerts for rabbitmq rabbitmq-server
Be the first to know when new unknown vulnerabilities affecting rabbitmq rabbitmq-server are published — delivered to Slack, Telegram or Discord.