CVE-2026-67229

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_vhost/2 calls rabbit_data_coercion:atomize_keys/1 (the unsafe variant using binary_to_atom) on the vhost metadata map. The 20 MB management body limit fits ~1M+ short keys. Admin-only. An administrator importing a crafted definitions file can crash the node in a single request: a vhosts entry with ~1M unique metadata keys exhausts the atom table during import. Preconditions include administrator tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Score

CVSS 4.0 6.9 Medium

Status

Analyzed - security-advisories@github.com

Published

2026-09-23

Last modified

2026-10-19

Weaknesses

CWE-400

Affected products

• Rabbitmq Server (Broadcom)
• Rabbitmq-server (Rabbitmq)

References

• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-ggrw-qm45-hwpv
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0