Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67227)

RabbitMQ server versions from 4.0.0 up to but not including 4.0.22, 4.1.14, 4.2.7, and 4.3.1 contain an atom exhaustion vulnerability (CVE-2026-67227). The vulnerability arises because the PUT and DELETE handlers for the /api/global-parameters/:name endpoint call rabbitdatacoercion:toatom/1 on the :name URL path segment, which uses the unsafe binarytoatom/2 function. This allows a user with the policymaker tag (a privilege level below management) to crash the node by exhausting the atom table through repeated unique requests to this endpoint. The vulnerability is resolved in RabbitMQ versions 4.0.22, 4.1.14, 4.2.7, and 4.3.1.

An attacker with the policymaker tag can cause a denial of service by crashing the RabbitMQ node through exhaustion of the Erlang atom table. This disrupts messaging and streaming services relying on the affected RabbitMQ instance. No remote code execution or data breach is indicated.

Upgrade RabbitMQ to version 4.0.22, 4.1.14, 4.2.7, or 4.3.1 or later, where this vulnerability is fixed. Restrict access to the policymaker tag to trusted users only. Patch status is confirmed by the vendor advisory.