# CVE-2026-67228: RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component

> An authorized policymaker can crash the RabbitMQ node by exhausting the Erlang atom table through repeated requests with unique component values.

- **Severity:** Medium 6.9 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** An administrator
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 23 Sep 2026
- **Updated:** 29 Sep 2026
- **Also known as:** AZL-105777, BIT-rabbitmq-2026-67228, DEBIAN-CVE-2026-67228, GHSA-73qp-fwh4-2q5g, UBUNTU-CVE-2026-67228

## What is CVE-2026-67228?

CVE-2026-67228 is a medium-severity denial of service vulnerability in rabbitmq-server, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.

### Official description

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbit_data_coercion:to_atom/1 in lookup_component/1 (deps/rabbit/src/rabbit_runtime_parameters.erl), creating a new atom for any previously unseen value. A safe helper, rabbit_registry:binary_to_type/1, which uses binary_to_existing_atom with a catch, already exists but is not used at this call site. lookup_component/1 calls rabbit_data_coercion:to_atom(Component) on the :component segment of the request URL, converting an attacker-supplied string into a new atom. Because the Erlang atom table is bounded and atoms are never garbage collected, an authorized policymaker issuing roughly one million requests with distinct component values can exhaust the atom table and crash the node, resulting in a denial of service. Preconditions include Exploitation requires policymaker privileges and roughly one million requests.. This issue is fixed in versions 4.2.7 and 4.3.1.

Weakness: CWE-400 (Uncontrolled Resource Consumption)

## Which versions are affected by CVE-2026-67228?

1 open source package ship an affected version, including rabbitmq.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `rabbitmq` | Bitnami | From 4.2.0 | 4.2.7, 4.3.1 |

## How do I fix CVE-2026-67228?

Upgrade rabbitmq to a fixed version for your release line: 4.2.7 or 4.3.1.

## Is CVE-2026-67228 being exploited?

There is no known exploitation of CVE-2026-67228 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-67228 and fix it if it is affected.

What it is: CVE-2026-67228 is a medium-severity denial of service vulnerability in rabbitmq-server, published on 23 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-67228 in the wild and no public exploit code.

Affected packages and fixed versions:
- rabbitmq (Bitnami): affected from 4.2.0; fixed in 4.2.7, 4.3.1

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-67228/ (Markdown: https://insights.sbomify.com/CVE-2026-67228/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-67228
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-67228
- OSV: https://osv.dev/vulnerability/CVE-2026-67228

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-67228/
Summaries are generated and may contain mistakes; the official description above is the record.