Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67226)

RabbitMQ server versions 4.0.0 through 4.0.21, versions prior to 4.1.14, and versions prior to 4.2.7 are vulnerable to an atom exhaustion vulnerability in the management API. Specifically, the PUT /api/users endpoint processes the user's tags list by mapping rabbitdatacoercion:toatom/1 over it. Because the management API limits the request body to about 20 MB, this allows an administrator to create or import a user with approximately one million unique tags, causing the node to crash due to atom exhaustion. This denial-of-service condition is remediated in versions 4.0.22, 4.1.14, and 4.2.7.

An administrator with access to the management API can cause a denial-of-service by crashing the RabbitMQ node with a single crafted request containing a very large number of unique tags. This could disrupt messaging services relying on the affected RabbitMQ server. There is no indication of privilege escalation or data disclosure from this vulnerability.

Upgrade RabbitMQ to version 4.0.22, 4.1.14, or 4.2.7 or later where this atom exhaustion vulnerability is fixed. No other mitigation or workaround is indicated. Since this requires administrator privileges to exploit, limiting administrative access to trusted personnel reduces risk.