CVE-2026-67228 RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component
An authorized policymaker can crash the RabbitMQ node by exhausting the Erlang atom table through repeated requests with unique component values.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-67228?
CVE-2026-67228 is a medium-severity denial of service vulnerability in rabbitmq-server, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbit_data_coercion:to_atom/1 in lookup_component/1 (deps/rabbit/src/rabbit_runtime_parameters.erl), creating a new atom for any previously unseen value. A safe helper, rabbit_registry:binary_to_type/1, which uses binary_to_existing_atom with a catch, already exists but is not used at this call site. lookup_component/1 calls rabbit_data_coercion:to_atom(Component) on the :component segment of the request URL, converting an attacker-supplied string into a new atom. Because the Erlang atom table is bounded and atoms are never garbage collected, an authorized policymaker issuing roughly one million requests with distinct component values can exhaust the atom table and crash the node, resulting in a denial of service. Preconditions include Exploitation requires policymaker privileges and roughly one million requests.. This issue is fixed in versions 4.2.7 and 4.3.1.
Weakness: CWE-400
Which versions are affected by CVE-2026-67228?
1 open source package ship an affected version, including rabbitmq.
| Package | Affected | Fixed in |
|---|---|---|
rabbitmq Bitnami | From 4.2.0 | 4.2.7, 4.3.1 |
How do I fix CVE-2026-67228?
Upgrade rabbitmq to a fixed version for your release line: 4.2.7 or 4.3.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-67228 being exploited?
There is no known exploitation of CVE-2026-67228 in the wild and no public exploit code.
Sources
Also known as AZL-105777, BIT-rabbitmq-2026-67228, DEBIAN-CVE-2026-67228, GHSA-73qp-fwh4-2q5g, UBUNTU-CVE-2026-67228.