Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-67238— RabbitMQ: Atom-table exhaustion via reply-to queue name decoding

Quick assessment

Affected
rabbitmq rabbitmq-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

RabbitMQ 是一个消息和流式代理系统。在版本 4.2.7 和 4.3.1 之前， 会解析由调用者提供的、采用 ETF（External Term Format）编码的二进制数据，并对节点名称（node-name）字段调用 函数。该函数可从 触发，而后者会在任何以 开头的队列名称或路由键被使用时被调用。候选节点（CandidateNodes）的成员资格检查是在原子（atom）创建之后进行的，且外层的 try/catch 结构无法回收已创建的原子（因为原子不会被垃圾回收机制回收）。此外，此处未使用 。任何经过身份

CVSS 7.1 · High EPSS 0.33% · P24
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-67238

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
RabbitMQ: Atom-table exhaustion via reply-to queue name decoding
Source: CVE Program / CVE List V5
Vulnerability Description
RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name / routing key beginning amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). binary_to_existing_atom is not used. Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests. Preconditions include Authenticated AMQP 0-9-1 connection to any vhost No per-connection rate limit low enough to make ~1M operations infeasible. This issue is fixed in versions 4.2.7 and 4.3.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
rabbitmq rabbitmq-server >= 4.2.0, < 4.2.7 -

II. Public POCs for CVE-2026-67238

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-67238

请登录查看更多情报信息。

Other References for CVE-2026-67238 (3)

Same Patch Batch · rabbitmq · 2026-09-23 · 25 CVEs total

CVE-2026-67404 9.2 CRITICAL RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
CVE-2026-67231 9.1 CRITICAL RabbitMQ: Trust-store whitelist by Issuer+Serial only
CVE-2026-66079 8.2 HIGH RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS
CVE-2026-67232 8.2 HIGH RabbitMQ: Web-MQTT decompression bomb
CVE-2026-66070 7.6 HIGH RabbitMQ: CORS * reflects Origin with Allow-Credentials
CVE-2026-66077 7.3 HIGH RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI
CVE-2026-67235 7.1 HIGH RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size
CVE-2026-67228 6.9 MEDIUM RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component
CVE-2026-67229 6.9 MEDIUM RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata
CVE-2026-66067 6.0 MEDIUM RabbitMQ: Stream protocol skips per vhost per user connection limits
CVE-2026-66074 6.0 MEDIUM RabbitMQ: ReDoS via management API ?name= filter
CVE-2026-66072 6.0 MEDIUM RabbitMQ: Atom table exhaustion via stream `chunk_selector`
CVE-2026-67219 6.0 MEDIUM RabbitMQ: Consistent-hash exchange unbounded weight
CVE-2026-67220 6.0 MEDIUM RabbitMQ: JMS topic exchange erl_scan atom exhaustion
CVE-2026-66080 5.9 MEDIUM RabbitMQ: Super-stream partitions unbounded allocation
CVE-2026-67221 5.9 MEDIUM RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords
CVE-2026-66068 5.6 MEDIUM RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs
CVE-2026-67405 5.3 MEDIUM RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation)
CVE-2026-66075 2.3 LOW RabbitMQ: Monitoring-tag user can restart federation links
CVE-2026-67240 2.3 LOW RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard

Showing top 20 of 25 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: rabbitmq-server
Same vendor: rabbitmq
Same weakness: CWE-400

V. Comments for CVE-2026-67238

No comments yet

Leave a comment