{"answers":{"affected":"1 open source package ship an affected version, including rabbitmq.","exploited":"There is no known exploitation of CVE-2026-67228 in the wild and no public exploit code.","fix":"Upgrade rabbitmq to a fixed version for your release line: 4.2.7 or 4.3.1.","what":"CVE-2026-67228 is a medium-severity denial of service vulnerability in rabbitmq-server, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-67228 and fix it if it is affected.\n\nWhat it is: CVE-2026-67228 is a medium-severity denial of service vulnerability in rabbitmq-server, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-67228 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- rabbitmq (Bitnami): affected from 4.2.0; fixed in 4.2.7, 4.3.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-67228/ (Markdown: https://insights.sbomify.com/CVE-2026-67228/index.md)","id":"CVE-2026-67228","markdown":"https://insights.sbomify.com/CVE-2026-67228/index.md","name":"CVE-2026-67228","record":{"aliases":["AZL-105777","BIT-rabbitmq-2026-67228","DEBIAN-CVE-2026-67228","GHSA-73qp-fwh4-2q5g","UBUNTU-CVE-2026-67228"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"RabbitMQ message broker","requires_auth":"high_privilege","summary":"An authorized policymaker can crash the RabbitMQ node by exhausting the Erlang atom table through repeated requests with unique component values.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.9,"severity":"medium","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"description":"RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbit_data_coercion:to_atom/1 in lookup_component/1 (deps/rabbit/src/rabbit_runtime_parameters.erl), creating a new atom for any previously unseen value. A safe helper, rabbit_registry:binary_to_type/1, which uses binary_to_existing_atom with a catch, already exists but is not used at this call site. lookup_component/1 calls rabbit_data_coercion:to_atom(Component) on the :component segment of the request URL, converting an attacker-supplied string into a new atom. Because the Erlang atom table is bounded and atoms are never garbage collected, an authorized policymaker issuing roughly one million requests with distinct component values can exhaust the atom table and crash the node, resulting in a denial of service. Preconditions include Exploitation requires policymaker privileges and roughly one million requests.. This issue is fixed in versions 4.2.7 and 4.3.1.","ecosystems":["Bitnami"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component","id":"CVE-2026-67228","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":1,"n_references":3,"next":{"headline":"RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata","id":"CVE-2026-67229"},"packages":[{"ecosystem":"Bitnami","fixed":["4.2.7","4.3.1"],"introduced":["4.2.0","4.3.0"],"last_affected":[],"package":"rabbitmq","purl":"pkg:bitnami/rabbitmq","source":"BIT-rabbitmq-2026-67228"}],"prev":{"headline":"RabbitMQ: Atom exhaustion: to_atom on global-parameter :name","id":"CVE-2026-67227"},"products":["rabbitmq-server"],"published":"2026-09-23","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-29","vendors":["rabbitmq"]},"summary":"An authorized policymaker can crash the RabbitMQ node by exhausting the Erlang atom table through repeated requests with unique component values.","url":"https://insights.sbomify.com/CVE-2026-67228/"}