CVE-2026-67228 Overview
CVE-2026-67228 is a denial of service vulnerability in RabbitMQ, an open-source messaging and streaming broker. The flaw resides in the runtime parameters lookup path, where the :component URL segment is coerced to an Erlang atom using rabbit_data_coercion:to_atom/1 inside lookup_component/1. Because the Erlang atom table is bounded and atoms are never garbage collected, an authorized user with policymaker privileges can exhaust the atom table by issuing distinct component values. The vulnerability affects RabbitMQ versions prior to 4.2.7 and 4.3.1. Exploitation requires roughly one million requests to crash a node, resulting in service disruption for downstream messaging consumers.
Critical Impact
An authenticated policymaker can crash a RabbitMQ node by exhausting the Erlang atom table, disrupting message queues and streaming workloads that depend on the broker.
Affected Products
- RabbitMQ Server versions prior to 4.2.7
- RabbitMQ Server versions prior to 4.3.1
- Deployments exposing runtime parameter management to policymaker-role users
Discovery Timeline
- 2026-09-23 - CVE-2026-67228 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-67228
Vulnerability Analysis
The vulnerability is a resource exhaustion issue classified under [CWE-400]. RabbitMQ exposes a runtime parameters HTTP interface that accepts a :component URL segment identifying the parameter component. Inside deps/rabbit/src/rabbit_runtime_parameters.erl, the function lookup_component/1 passes this attacker-controlled string to rabbit_data_coercion:to_atom/1. That helper unconditionally creates a new Erlang atom for any previously unseen input.
Erlang maintains a global atom table with a hard upper bound, and entries are never garbage collected. Repeatedly injecting unique component values forces the runtime to allocate new atoms until the table is exhausted. Once the limit is reached, the Erlang VM terminates the node, halting message brokering.
A safer helper, rabbit_registry:binary_to_type/1, already exists in the codebase. It uses binary_to_existing_atom wrapped in a catch to reject unknown values without creating atoms. The vulnerable call site did not use this helper.
Root Cause
The root cause is unsafe string-to-atom conversion of untrusted input. rabbit_data_coercion:to_atom/1 calls binary_to_atom rather than binary_to_existing_atom, allowing arbitrary attacker-supplied strings to permanently consume atom table slots.
Attack Vector
An authenticated user holding the policymaker role sends approximately one million HTTP requests to the runtime parameters endpoint. Each request supplies a unique :component path segment. Every distinct value allocates a new atom, and once the atom table saturates, the broker node crashes. The attack is remote, requires only low complexity, and does not need user interaction.
Code-level exploitation details are described in prose only. See the GitHub Security Advisory GHSA-73qp-fwh4-2q5g for the upstream analysis.
Detection Methods for CVE-2026-67228
Indicators of Compromise
- High volumes of HTTP requests to the /api/parameters/:component/... management endpoint with rapidly varying :component segment values from a single authenticated principal.
- Erlang VM crash logs referencing atom table exhaustion, typically system_limit errors tied to atom allocation.
- Sudden node restarts or cluster partition events in RabbitMQ logs correlated with management API traffic spikes.
Detection Strategies
- Baseline normal usage of the runtime parameters API and alert on requests-per-minute anomalies from any single user or API token.
- Monitor Erlang atom count metrics exposed by erlang:memory(atom) and erlang:system_info(atom_count) and alert when values approach the configured atom table limit.
- Correlate management-plane authentication events for the policymaker role with volumetric request patterns.
Monitoring Recommendations
- Ingest RabbitMQ management API access logs and Erlang VM crash dumps into a centralized logging platform for correlation.
- Track cluster node uptime and unexpected restarts as a secondary signal of resource exhaustion attempts.
- Review policymaker role assignments periodically and alert on new grants to this privileged role.
How to Mitigate CVE-2026-67228
Immediate Actions Required
- Upgrade RabbitMQ to version 4.2.7 or 4.3.1, which replace the unsafe atom coercion at the vulnerable call site.
- Audit accounts assigned the policymaker role and remove the role from principals that do not require runtime parameter management.
- Restrict network access to the RabbitMQ management API to trusted operator networks only.
Patch Information
The RabbitMQ maintainers fixed this issue in versions 4.2.7 and 4.3.1. The patch replaces the unsafe rabbit_data_coercion:to_atom/1 call in lookup_component/1 with a helper that uses binary_to_existing_atom, preventing arbitrary atom creation. See the RabbitMQ Server v4.2.7 release notes and the RabbitMQ Server v4.3.1 release notes for upgrade guidance.
Workarounds
- Apply strict rate limiting at a reverse proxy in front of the RabbitMQ management API to cap requests per authenticated user.
- Reduce the number of accounts granted the policymaker tag to the minimum required for operations.
- Increase the Erlang atom table limit via the +t VM flag as a temporary buffer, understanding this delays rather than prevents exhaustion.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
