Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67415)

RabbitMQ versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2 contain a vulnerability in the Shovel parameter parser where attacker-controlled runtime parameters are converted into non-garbage-collected Erlang atoms without sufficient validation. This can lead to exhaustion of the node-wide atom table, resulting in denial of service. Exploitation requires network access to the Management HTTP API, valid credentials with both management and policymaker tags, permission to set Shovel runtime parameters on a virtual host, and the rabbitmq_shovel and rabbitmq_shovel_management plugins enabled. Malicious parameters are stored durably and re-applied on worker restarts, allowing persistent atom table pressure. The vulnerability is resolved in RabbitMQ versions 4.2.9 and 4.3.3.

An attacker with appropriate credentials and permissions can cause a denial of service by exhausting the Erlang atom table on the RabbitMQ node. This can disrupt messaging and streaming services. The persistent nature of the malicious parameters means the denial of service condition can recur after service restarts without active attacker presence.

This vulnerability is fixed in RabbitMQ versions 4.2.9 and 4.3.3. Users should upgrade to these or later versions to remediate the issue. No other mitigation actions are specified or required if the system is updated.