CVE-2026-67229— RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata
Quick assessment
Affected
rabbitmq rabbitmq-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
RabbitMQ 是一个消息代理和流处理中间件。在版本 3.13.15、4.0.20、4.1.11、4.2.6 和 4.3.0 之前， 函数会对 vhost 元数据映射表调用 （该函数使用不安全的 方法将二进制数据转换为原子）。管理界面的请求体大小限制为 20 MB，该限制下可容纳超过 100 万个短键。此漏洞仅限管理员权限触发。管理员若导入精心构造的定义文件，可在单次请求中导致节点崩溃：当 vhosts 条目中包含约 100 万个唯一元数据键时，会在导入过程中耗尽原子表（atom table）。触发该漏洞的前提条
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-67229
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata
Source: CVE Program / CVE List V5
Vulnerability Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_vhost/2 calls rabbit_data_coercion:atomize_keys/1 (the unsafe variant using binary_to_atom) on the vhost metadata map. The 20 MB management body limit fits ~1M+ short keys. Admin-only. An administrator importing a crafted definitions file can crash the node in a single request: a vhosts entry with ~1M unique metadata keys exhausts the atom table during import. Preconditions include administrator tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| rabbitmq | rabbitmq-server | >= 3.13.0, < 3.13.15 | - |
|
II. Public POCs for CVE-2026-67229
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-67229
请登录查看更多情报信息。
Vendor Pages for CVE-2026-67229 (1)
Other References for CVE-2026-67229 (2)
-
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0 x_refsource_MISC
Same Patch Batch · rabbitmq · 2026-09-23 · 25 CVEs total
| CVE-2026-67404 | 9.2 CRITICAL | RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch |
| CVE-2026-67231 | 9.1 CRITICAL | RabbitMQ: Trust-store whitelist by Issuer+Serial only |
| CVE-2026-66079 | 8.2 HIGH | RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS |
| CVE-2026-67232 | 8.2 HIGH | RabbitMQ: Web-MQTT decompression bomb |
| CVE-2026-66070 | 7.6 HIGH | RabbitMQ: CORS * reflects Origin with Allow-Credentials |
| CVE-2026-66077 | 7.3 HIGH | RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI |
| CVE-2026-67235 | 7.1 HIGH | RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size |
| CVE-2026-67238 | 7.1 HIGH | RabbitMQ: Atom-table exhaustion via reply-to queue name decoding |
| CVE-2026-67228 | 6.9 MEDIUM | RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component |
| CVE-2026-66067 | 6.0 MEDIUM | RabbitMQ: Stream protocol skips per vhost per user connection limits |
| CVE-2026-66074 | 6.0 MEDIUM | RabbitMQ: ReDoS via management API ?name= filter |
| CVE-2026-67219 | 6.0 MEDIUM | RabbitMQ: Consistent-hash exchange unbounded weight |
| CVE-2026-66072 | 6.0 MEDIUM | RabbitMQ: Atom table exhaustion via stream `chunk_selector` |
| CVE-2026-67220 | 6.0 MEDIUM | RabbitMQ: JMS topic exchange erl_scan atom exhaustion |
| CVE-2026-66080 | 5.9 MEDIUM | RabbitMQ: Super-stream partitions unbounded allocation |
| CVE-2026-67221 | 5.9 MEDIUM | RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords |
| CVE-2026-66068 | 5.6 MEDIUM | RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs |
| CVE-2026-67405 | 5.3 MEDIUM | RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) |
| CVE-2026-66075 | 2.3 LOW | RabbitMQ: Monitoring-tag user can restart federation links |
| CVE-2026-67240 | 2.3 LOW | RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: rabbitmq-server
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same vendor: rabbitmq
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same weakness: CWE-400
-
CVE-2026-94408
Uncontrolled Resource Consumption in Elasticsearch Leading t -
CVE-2026-94397
Uncontrolled Resource Consumption in Elasticsearch Leading t -
CVE-2026-94396
Uncontrolled Resource Consumption in Elasticsearch Leading t -
CVE-2026-94400
Uncontrolled Resource Consumption in Kibana Leading to denia -
CVE-2026-94399
Uncontrolled Resource Consumption in Elasticsearch Leading t
V. Comments for CVE-2026-67229
No comments yet