Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-66073)
Description
CVE-2026-66073 is a vulnerability in RabbitMQ server versions from 3.13.0 up to but not including 3.13.15, and in versions 4.0.20, 4.1.11, and 4.2.6. It involves atom table exhaustion via the management API's node field, which can cause the Erlang VM to crash after approximately 900,000 requests, resulting in denial of service for all tenants. The vulnerability affects users with the management tag and access to at least one virtual host. The issue was introduced in a March 2026 refactoring and fixed in the specified versions.
CVSS v3.1
Score 6.5medium
Affected software
pkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=jammypkg:deb/ubuntu/rabbitmq-server?arch=source&distro=noblepkg:deb/ubuntu/rabbitmq-server?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RabbitMQ server versions 3.13.0 through 3.13.14, and versions prior to 4.0.20, 4.1.11, and 4.2.6, are vulnerable to atom table exhaustion via the management API's node JSON field. The PUT /api/queues/:vhost/:name endpoint (and similar endpoints for exchanges and bindings) accepts a node field whose value is converted into an atom without proper cluster membership checks. Each unique value permanently leaks one atom, eventually exhausting the atom table and crashing the Erlang VM. The vulnerability was introduced in a March 2026 code refactor that added safer helpers but missed the getnode/1 function used by directrequest/6. Approximately 900,000 crafted requests can cause a system limit crash, denying service to all tenants. The vulnerability requires only management tag privileges and access to one virtual host. Fixed in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Potential Impact
Successful exploitation leads to exhaustion of the Erlang VM atom table, causing the RabbitMQ server to crash and resulting in denial of service for all tenants on the server. No confidentiality or integrity impacts are described. The attack requires management tag privileges and access to at least one virtual host, which is a low privilege level within RabbitMQ's management API.
Mitigation Recommendations
This vulnerability is fixed in RabbitMQ versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. Users should upgrade to these or later versions to remediate the issue. No other mitigations or workarounds are specified.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-66073
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f5af2cdf04f65666281e
Added to database: 10/17/2026, 22:24:47 UTC
Last enriched: 10/18/2026, 00:08:56 UTC
Last updated: 10/18/2026, 00:08:56 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.