Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67228)
Description
CVE-2026-67228 is a denial of service vulnerability in RabbitMQ server prior to versions 4.2.7 and 4.3.1. The issue arises from the runtime-parameters lookup path converting attacker-supplied URL components into new Erlang atoms without checking if they already exist. Because atoms are not garbage collected and the atom table is bounded, an attacker with policymaker privileges can exhaust the atom table by issuing roughly one million distinct requests, causing the RabbitMQ node to crash. This vulnerability is fixed in versions 4.2.7 and 4.3.1.
CVSS v4.0
Affected software
pkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=jammypkg:deb/ubuntu/rabbitmq-server?arch=source&distro=noblepkg:deb/ubuntu/rabbitmq-server?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RabbitMQ versions before 4.2.7 and 4.3.1 contain a vulnerability in the runtime-parameters lookup path where the :component segment of the request URL is coerced into a new Erlang atom using rabbit_data_coercion:to_atom/1. This function creates a new atom for any previously unseen value without using the safer rabbit_registry:binary_to_type/1 helper that checks for existing atoms. Since Erlang atoms are never garbage collected and the atom table size is limited, an authorized policymaker can exhaust the atom table by sending approximately one million requests with distinct component values, leading to a denial of service via node crash. The vulnerability requires policymaker privileges to exploit and is addressed by fixes in RabbitMQ versions 4.2.7 and 4.3.1.
Potential Impact
An attacker with policymaker privileges can cause a denial of service by exhausting the Erlang atom table through repeated requests with unique component values. This results in the RabbitMQ node crashing, disrupting messaging and streaming services. No remote code execution or data disclosure is indicated. Exploitation requires authorized access and a high volume of requests.
Mitigation Recommendations
This vulnerability is fixed in RabbitMQ versions 4.2.7 and 4.3.1. Users should upgrade to these or later versions to remediate the issue. Until upgraded, restrict policymaker privileges to trusted users only to reduce risk. Patch status is confirmed fixed in the specified versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-67228
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad3f5aa2cdf04f6566627f5
Added to database: 10/17/2026, 22:24:42 UTC
Last enriched: 10/18/2026, 00:03:59 UTC
Last updated: 10/18/2026, 00:03:59 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.