CVE-2026-67227: RabbitMQ Atom Exhaustion DOS Vulnerability

CVE-2026-67227 Overview

CVE-2026-67227 is a denial of service vulnerability in RabbitMQ, an open-source messaging and streaming broker. The flaw affects RabbitMQ versions 4.0.0 through 4.0.21, 4.1.x prior to 4.1.14, 4.2.x prior to 4.2.7, and 4.3.x prior to 4.3.1. An authenticated user with the policymaker tag can exhaust the Erlang virtual machine atom table by issuing repeated requests to /api/global-parameters/:name with unique path segments. The unsafe conversion in rabbit_data_coercion:to_atom/1 relies on binary_to_atom/2, which permanently allocates atoms until the node crashes. The issue is tracked as [CWE-400: Uncontrolled Resource Consumption] and resolved in 4.0.22, 4.1.14, 4.2.7, and 4.3.1.

Critical Impact
An authenticated policymaker user can crash the broker node by sending roughly one million HTTP requests with unique parameter names, exhausting the fixed-size atom table.

Affected Products

RabbitMQ Server 4.0.0 through 4.0.21
RabbitMQ Server 4.1.0 through 4.1.13
RabbitMQ Server 4.2.0 through 4.2.6 and 4.3.0

Discovery Timeline

2026-09-25 - CVE-2026-67227 published to NVD
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-67227

Vulnerability Analysis

The vulnerability resides in the RabbitMQ management plugin, specifically in rabbit_mgmt_wm_global_parameter.erl. The resource_exists/2 function and the PUT/DELETE handlers call rabbit_data_coercion:to_atom/1 on the :name URL path segment. That coercion internally uses the Erlang built-in binary_to_atom/2, which creates a new atom on each unique input.

Erlang maintains a global atom table with a hard-coded upper bound, defaulting to 1,048,576 entries. Atoms are never garbage collected during the lifetime of a node. Each unique :name sent to the endpoint consumes a slot in this table. Once the limit is reached, the Erlang virtual machine terminates, taking the RabbitMQ broker with it.

Root Cause

The root cause is the use of the unsafe binary_to_atom/2 on attacker-controlled input in an HTTP routing handler. Safe alternatives such as binary_to_existing_atom/2 restrict conversion to atoms already present in the table and would reject arbitrary names.

Attack Vector

Exploitation requires network access to the management HTTP API and authenticated credentials carrying the policymaker tag. The attacker iterates HTTP requests against /api/global-parameters/:name, varying :name on each request until the atom table fills. Approximately one million unique requests are sufficient to crash the node.

erlang

           Val = if is_map(Value) -> maps:to_list(Value);
                     true         -> Value
                 end,
-          rabbit_runtime_parameters:set_global(name(ReqData), Val, Username),
+          rabbit_runtime_parameters:set_global(raw_name(ReqData), Val, Username),
           {true, ReqData, Context}
       end).

The patch replaces the atom-producing name/1 helper with raw_name/1, which preserves the parameter name as a binary and avoids the unsafe conversion. Source: RabbitMQ commit 8fbe6d8 and RabbitMQ commit fc591e7.

Detection Methods for CVE-2026-67227

Indicators of Compromise

High-volume HTTP requests to /api/global-parameters/<unique-name> from a single authenticated identity.
Rapid growth in the Erlang atom table count visible in erlang:memory(atom_used) or rabbitmq-diagnostics runtime_thread_stats.
Unexpected RabbitMQ node restarts preceded by system_limit errors referencing atom allocation.

Detection Strategies

Alert on anomalous request rates against PUT/DELETE on /api/global-parameters/ with high name cardinality per source IP or user.
Monitor Erlang VM metrics for sustained increases in atom count toward the configured ceiling.
Correlate management plugin access logs with user tag assignments to identify policymaker accounts behaving abnormally.

Monitoring Recommendations

Enable RabbitMQ access logging for the management plugin and ship events to a centralized log store.
Track rabbitmq_erlang_vm_atom_count and related Prometheus metrics with thresholds set well below the 1M limit.
Review audit logs for accounts carrying the policymaker tag and remove the tag where it is not required.

How to Mitigate CVE-2026-67227

Immediate Actions Required

Upgrade RabbitMQ to 4.0.22, 4.1.14, 4.2.7, or 4.3.1 depending on the deployed branch.
Audit user accounts and remove the policymaker tag from identities that do not require policy management.
Restrict network access to the management HTTP API to trusted administrative networks only.

Patch Information

Fixed versions are available in RabbitMQ Release v4.2.7 and RabbitMQ Release v4.3.1. Additional details are documented in RabbitMQ Security Advisory GHSA-q7x8-97rh-cr24. The fix refactors the global parameter handlers to use raw binary names rather than converting attacker-supplied input to atoms.

Workarounds

Disable the management plugin on nodes where HTTP API access is not required with rabbitmq-plugins disable rabbitmq_management.
Place the management API behind a reverse proxy that rate-limits requests to /api/global-parameters/.
Reduce exposure by removing the policymaker tag from all non-administrative users until patching is complete.

bash

# Verify installed version and upgrade path
rabbitmqctl version
rabbitmq-plugins list -e rabbitmq_management

# Remove the policymaker tag from a user as a temporary mitigation
rabbitmqctl set_user_tags <username> management

# Monitor atom table usage on a running node
rabbitmq-diagnostics runtime_thread_stats
rabbitmqctl eval 'erlang:system_info(atom_count).'