Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67238)
Description
CVE-2026-67238 is a vulnerability in RabbitMQ server prior to versions 4.2.7 and 4.3.1. It involves improper handling of caller-supplied ETF-encoded binaries in the rabbit_pid_codec:decompose_from_binary/1 function, which can lead to exhaustion of atoms in the Erlang VM. An authenticated AMQP client can exploit this by sending approximately one million crafted requests, causing the entire Erlang VM to crash, affecting all virtual hosts and connections. The issue is fixed in RabbitMQ versions 4.2.7 and 4.3.1.
CVSS v4.0
Affected software
pkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=jammypkg:deb/ubuntu/rabbitmq-server?arch=source&distro=noblepkg:deb/ubuntu/rabbitmq-server?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RabbitMQ versions prior to 4.2.7 and 4.3.1 contain a vulnerability in the rabbit_pid_codec:decompose_from_binary/1 function. This function parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field without using binary_to_existing_atom, leading to atom exhaustion since atoms are not garbage collected. The vulnerability is reachable via rabbit_volatile_queue:pid_from_name/2 for any queue name or routing key beginning with amq.rabbitmq.reply-to.. An authenticated AMQP 0-9-1 client can trigger this by sending around one million crafted requests, causing the Erlang VM to crash and disrupt all virtual hosts and connections. The vulnerability requires no user interaction and has a low attack complexity but requires authentication and no rate limiting to be effective. The issue is resolved in RabbitMQ versions 4.2.7 and 4.3.1.
Potential Impact
Exploitation allows any authenticated AMQP client to crash the entire Erlang VM running RabbitMQ, resulting in denial of service affecting all virtual hosts and connections on the server. This can disrupt messaging and streaming services relying on RabbitMQ until the server is restarted or patched.
Mitigation Recommendations
A fix is available in RabbitMQ versions 4.2.7 and 4.3.1. Users should upgrade to these or later versions to remediate the vulnerability. Until patched, implementing per-connection rate limiting to prevent approximately one million operations per connection may reduce the risk of exploitation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-67238
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
- State
- PUBLISHED
Patch Information
Threat ID: 6ad3f5a92cdf04f6566627e9
Added to database: 10/17/2026, 22:24:41 UTC
Last enriched: 10/17/2026, 23:59:04 UTC
Last updated: 10/17/2026, 23:59:04 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.