CVE-2026-67228
published 2026-09-23CVE-2026-67228: RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an…
PriorityP337medium6.9CVSS 4.0
AVNACLATNPRHUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.28%
19.2th percentile
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbit_data_coercion:to_atom/1 in lookup_component/1 (deps/rabbit/src/rabbit_runtime_parameters.erl), creating a new atom for any previously unseen value. A safe helper, rabbit_registry:binary_to_type/1, which uses binary_to_existing_atom with a catch, already exists but is not used at this call site. lookup_component/1 calls rabbit_data_coercion:to_atom(Component) on the :component segment of the request URL, converting an attacker-supplied string into a new atom. Because the Erlang atom table is bounded and atoms are never garbage collected, an authorized policymaker issuing roughly one million requests with distinct component values can exhaust the atom table and crash the node, resulting in a denial of service. Preconditions include Exploitation requires policymaker privileges and roughly one million requests.. This issue is fixed in versions 4.2.7 and 4.3.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
CVSS provenance
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
RabbitMQ up to 4.2.6/4.3.0 Runtime Parameter Lookup rabbit_runtime_parameters.erl lookup_component Component denial of service
vuldb·2026-09-23·CVSS 6.9
CVE-2026-67228 [MEDIUM] RabbitMQ up to 4.2.6/4.3.0 Runtime Parameter Lookup rabbit_runtime_parameters.erl lookup_component Component denial of service
A vulnerability was found in RabbitMQ up to 4.2.6/4.3.0. It has been classified as problematic. This vulnerability affects the function lookup_component of the file deps/rabbit/src/rabbit_runtime_parameters.erl of the component Runtime Parameter Lookup. This manipulation of the argument Component causes denial of service.
This vulnerability is registered as CVE-2026-67228. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is recommended.
Red Hat
rabbitmq: RabbitMQ: Denial of Service via atom exhaustion in runtime-parameter component
vendor_redhat·2026-09-23·CVSS 6.9
CVE-2026-67228 [MEDIUM] CWE-770 rabbitmq: RabbitMQ: Denial of Service via atom exhaustion in runtime-parameter component
rabbitmq: RabbitMQ: Denial of Service via atom exhaustion in runtime-parameter component
A flaw was found in RabbitMQ. An authorized policymaker can exploit this vulnerability by issuing a large number of requests with distinct component values to the runtime-parameters lookup path. This action coerces attacker-supplied strings into new atoms, eventually exhausting the Erlang atom table. Successful exploitation leads to a denial of service by crashing the RabbitMQ node.
Package: rabbitmq-server4.2 (Red Hat Hardened Images) - Will not fix
Package: rabbitmq-server4.3 (Red Hat Hardened Images) - Affected
No detection rules found.
No public exploits indexed.
2026-09-23
Published