CVE-2026-67228— RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component
Quick assessment
Affected
rabbitmq rabbitmq-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
RabbitMQ 是一个消息和流式处理代理。在 4.2.7 和 4.3.1 版本之前， 函数（位于 ）在处理运行时参数查找路径时，会将 URL 的 片段通过 强制转换为原子（atom），从而为任何之前未见过的新值创建一个新的原子。实际上，系统中已存在一个安全的辅助函数 ，它使用带有异常捕获的 ，但该函数在当前的调用点并未被使用。 会对请求 URL 中的 片段调用 ，将攻击者提供的字符串转换为一个新的原子。由于 Erlang 的原子表大小是有限的，且原子永远不会被垃圾回收，因此，拥有策略配置权限的攻击者只需发出大约一
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-67228
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component
Source: CVE Program / CVE List V5
Vulnerability Description
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbit_data_coercion:to_atom/1 in lookup_component/1 (deps/rabbit/src/rabbit_runtime_parameters.erl), creating a new atom for any previously unseen value. A safe helper, rabbit_registry:binary_to_type/1, which uses binary_to_existing_atom with a catch, already exists but is not used at this call site. lookup_component/1 calls rabbit_data_coercion:to_atom(Component) on the :component segment of the request URL, converting an attacker-supplied string into a new atom. Because the Erlang atom table is bounded and atoms are never garbage collected, an authorized policymaker issuing roughly one million requests with distinct component values can exhaust the atom table and crash the node, resulting in a denial of service. Preconditions include Exploitation requires policymaker privileges and roughly one million requests.. This issue is fixed in versions 4.2.7 and 4.3.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| rabbitmq | rabbitmq-server | >= 4.2.0, < 4.2.7 | - |
|
II. Public POCs for CVE-2026-67228
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-67228
请登录查看更多情报信息。
Other References for CVE-2026-67228 (3)
-
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1 x_refsource_MISC
-
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7 x_refsource_MISC
Same Patch Batch · rabbitmq · 2026-09-23 · 25 CVEs total
| CVE-2026-67404 | 9.2 CRITICAL | RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch |
| CVE-2026-67231 | 9.1 CRITICAL | RabbitMQ: Trust-store whitelist by Issuer+Serial only |
| CVE-2026-66079 | 8.2 HIGH | RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS |
| CVE-2026-67232 | 8.2 HIGH | RabbitMQ: Web-MQTT decompression bomb |
| CVE-2026-66070 | 7.6 HIGH | RabbitMQ: CORS * reflects Origin with Allow-Credentials |
| CVE-2026-66077 | 7.3 HIGH | RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI |
| CVE-2026-67235 | 7.1 HIGH | RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size |
| CVE-2026-67238 | 7.1 HIGH | RabbitMQ: Atom-table exhaustion via reply-to queue name decoding |
| CVE-2026-67229 | 6.9 MEDIUM | RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata |
| CVE-2026-66067 | 6.0 MEDIUM | RabbitMQ: Stream protocol skips per vhost per user connection limits |
| CVE-2026-66074 | 6.0 MEDIUM | RabbitMQ: ReDoS via management API ?name= filter |
| CVE-2026-67219 | 6.0 MEDIUM | RabbitMQ: Consistent-hash exchange unbounded weight |
| CVE-2026-66072 | 6.0 MEDIUM | RabbitMQ: Atom table exhaustion via stream `chunk_selector` |
| CVE-2026-67220 | 6.0 MEDIUM | RabbitMQ: JMS topic exchange erl_scan atom exhaustion |
| CVE-2026-66080 | 5.9 MEDIUM | RabbitMQ: Super-stream partitions unbounded allocation |
| CVE-2026-67221 | 5.9 MEDIUM | RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords |
| CVE-2026-66068 | 5.6 MEDIUM | RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs |
| CVE-2026-67405 | 5.3 MEDIUM | RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) |
| CVE-2026-66075 | 2.3 LOW | RabbitMQ: Monitoring-tag user can restart federation links |
| CVE-2026-67240 | 2.3 LOW | RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: rabbitmq-server
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same vendor: rabbitmq
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same weakness: CWE-400
-
CVE-2026-94408
Uncontrolled Resource Consumption in Elasticsearch Leading t -
CVE-2026-94397
Uncontrolled Resource Consumption in Elasticsearch Leading t -
CVE-2026-94396
Uncontrolled Resource Consumption in Elasticsearch Leading t -
CVE-2026-94400
Uncontrolled Resource Consumption in Kibana Leading to denia -
CVE-2026-94399
Uncontrolled Resource Consumption in Elasticsearch Leading t
V. Comments for CVE-2026-67228
No comments yet