CVE-2026-66072: RabbitMQ Stream Protocol DOS Vulnerability

CVE-2026-66072 Overview

CVE-2026-66072 is a denial-of-service vulnerability in the RabbitMQ messaging and streaming broker. The flaw resides in the rabbitmq_stream plugin, where the get_chunk_selector/1 function calls Erlang's binary_to_atom on the raw client-supplied <<"chunk_selector">> property. Because the code applies no whitelist and no guard, an authenticated stream client with read access to any stream can crash the broker node. The issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.

Critical Impact
An authenticated stream-protocol user with read access to a single stream can crash the RabbitMQ broker node by sending crafted subscribe or resolve_offset_spec frames, resulting in service disruption for all connected clients.

Affected Products

RabbitMQ Server versions prior to 3.13.15
RabbitMQ Server 4.0.x prior to 4.0.20, 4.1.x prior to 4.1.11, and 4.2.x prior to 4.2.6
RabbitMQ Server 4.3.x prior to 4.3.1 with the rabbitmq_stream plugin enabled

Discovery Timeline

2026-09-23 - CVE-2026-66072 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-66072

Vulnerability Analysis

The vulnerability is a resource exhaustion issue tracked under CWE-400. RabbitMQ's stream protocol handler processes client frames including subscribe and resolve_offset_spec. Both frames carry a chunk_selector property that determines which stream chunks the client wants to receive.

The broker's get_chunk_selector/1 function converts this client-controlled binary into an Erlang atom using binary_to_atom. Erlang's atom table is a finite, non-garbage-collected resource. Once an unbounded set of unique atoms is created, the node exhausts its atom table and crashes.

Because the input passes through no allowlist or type guard, any authenticated stream client can trigger the unsafe conversion. Repeated frames with distinct chunk_selector values eventually terminate the broker process.

Root Cause

The root cause is unsafe use of binary_to_atom on untrusted input. The function creates a new atom whenever the input string has not been seen before. RabbitMQ should have used binary_to_existing_atom or an explicit allowlist of the accepted selector values (for example, user_data, os_time, or chunk_id) before performing the conversion.

Attack Vector

Exploitation requires network access to the stream listener, valid credentials for a stream-protocol user, and read permission on at least one stream. The attacker sends subscribe or resolve_offset_spec frames containing arbitrary or randomized values for the chunk_selector property. Each unique value inflates the atom table until the broker node aborts. The attack requires no user interaction and produces no confidentiality or integrity impact, only availability loss.

See the GitHub Security Advisory GHSA-48hm-chgv-398r for the upstream technical description.

Detection Methods for CVE-2026-66072

Indicators of Compromise

Unexpected termination of beam.smp processes or RabbitMQ node crashes with atom-table exhaustion messages in the Erlang crash dump
High-frequency subscribe or resolve_offset_spec frames from a single authenticated stream user
Rapid growth of the Erlang atom count reported by erlang:system_info(atom_count) prior to broker failure

Detection Strategies

Monitor RabbitMQ management metrics for anomalous stream-protocol frame rates on TCP port 5552
Enable audit logging for stream authentication and correlate crashes with recently connected stream users
Review Erlang crash dumps for system_limit errors referencing the atom table after unexpected node restarts

Monitoring Recommendations

Baseline the atom count on healthy broker nodes and alert on sustained growth beyond normal operational values
Track cluster node availability and restart counts through Prometheus or the RabbitMQ management plugin
Log all stream-protocol client connections including source IP, username, and authorized virtual host for post-incident forensics

How to Mitigate CVE-2026-66072

Immediate Actions Required

Upgrade RabbitMQ Server to a fixed release: 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.1
If patching is not immediately possible, disable the rabbitmq_stream plugin on brokers that do not require stream-protocol functionality
Restrict network exposure of the stream listener (default TCP port 5552) to trusted client subnets only
Rotate stream-protocol credentials and audit which accounts hold read permission on streams

Patch Information

Upstream fixes are available in the RabbitMQ Server v4.2.6 release and the RabbitMQ Server v4.3.1 release. Corresponding patched builds are available for the 3.13.x, 4.0.x, and 4.1.x branches as 3.13.15, 4.0.20, and 4.1.11 respectively. The fix replaces the unsafe conversion with a bounded lookup of known chunk selector values.

Workarounds

Disable the rabbitmq_stream plugin using rabbitmq-plugins disable rabbitmq_stream on nodes where streams are not required
Remove read permissions on streams for any user that does not have a documented operational need
Place a network-layer allowlist in front of the stream listener to prevent untrusted clients from reaching the broker

bash

# Disable the rabbitmq_stream plugin as a temporary mitigation
rabbitmq-plugins disable rabbitmq_stream

# Verify the plugin is no longer active
rabbitmq-plugins list -e | grep stream