CVE-2026-67229 Overview
CVE-2026-67229 is a denial of service vulnerability in RabbitMQ, an open-source messaging and streaming broker. The flaw exists in the add_vhost/2 function, which calls the unsafe rabbit_data_coercion:atomize_keys/1 variant. This variant uses binary_to_atom on vhost metadata map keys during definitions import. An administrator importing a crafted definitions file with a vhosts entry containing roughly one million unique metadata keys can exhaust the Erlang atom table and crash the node in a single request. The 20 MB management HTTP body limit accommodates well over one million short keys. The issue affects versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Critical Impact
An authenticated administrator can crash a RabbitMQ broker node with a single crafted definitions import, disrupting messaging availability across dependent applications.
Affected Products
- RabbitMQ Server versions prior to 3.13.15
- RabbitMQ Server versions prior to 4.0.20, 4.1.11, and 4.2.6
- RabbitMQ Server versions prior to 4.3.0
Discovery Timeline
- 2026-09-23 - CVE-2026-67229 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-67229
Vulnerability Analysis
The vulnerability is a resource exhaustion issue classified as [CWE-400]. RabbitMQ processes vhost metadata during definitions import by coercing map keys to Erlang atoms. Atoms in the Erlang virtual machine are stored in a global, non-garbage-collected table with a default maximum of 1,048,576 entries. When the atom table fills, the VM terminates.
The add_vhost/2 code path invokes rabbit_data_coercion:atomize_keys/1, which internally calls binary_to_atom on every key in the supplied metadata map. Because atoms are never reclaimed, a single import request containing a large map of unique short keys consumes the remaining capacity and crashes the broker.
Root Cause
The root cause is the use of the unsafe atom conversion variant on untrusted map keys. The safer alternative, binary_to_existing_atom, would reject unknown values, but the code path uses unconditional atom creation. The 20 MB HTTP body limit on the management API does not constrain the number of short keys, allowing more than one million entries to fit within a single request payload.
Attack Vector
Exploitation requires network access to the management API and an account with the administrator tag. The attacker crafts a definitions JSON file containing a vhost entry whose metadata map holds approximately one million unique keys. Importing this file through the management HTTP endpoint triggers atom-table exhaustion and terminates the Erlang node.
No verified exploit code is publicly available. See the GitHub Security Advisory GHSA-ggrw-qm45-hwpv for the vendor's technical description.
Detection Methods for CVE-2026-67229
Indicators of Compromise
- Unexpected node crashes accompanied by Erlang VM termination messages referencing system_limit or atom table exhaustion in the RabbitMQ server logs.
- Management API POST requests to /api/definitions or vhost import endpoints with unusually large JSON payloads approaching the 20 MB body limit.
- Definitions files containing vhost entries with metadata maps holding thousands or millions of unique keys.
Detection Strategies
- Monitor RabbitMQ log files for atom table growth warnings and abnormal broker restarts correlated with administrative API activity.
- Inspect HTTP access logs on the management plugin for large-body POST requests to definitions import endpoints, especially from newly created or rarely used administrator accounts.
- Alert on any node restart events that occur within seconds of a definitions import operation.
Monitoring Recommendations
- Track the Erlang atom count via erlang:system_info(atom_count) and alert when utilization exceeds a defined threshold of the configured maximum.
- Audit creation and use of accounts holding the administrator tag, and require change-control approval for any definitions import.
- Forward RabbitMQ and management API logs to a centralized analytics platform to correlate administrative actions with broker availability events.
How to Mitigate CVE-2026-67229
Immediate Actions Required
- Upgrade RabbitMQ to a fixed version: 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0.
- Review and reduce the number of accounts assigned the administrator tag on all brokers.
- Restrict network access to the management HTTP API to trusted operator networks only.
Patch Information
RabbitMQ addressed the issue in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. Refer to the RabbitMQ v4.2.6 Release notes and the RabbitMQ v4.3.0 Release notes for upgrade guidance. Full technical details are in the GitHub Security Advisory GHSA-ggrw-qm45-hwpv.
Workarounds
- Disable the management plugin or bind it exclusively to localhost where remote definitions import is not required.
- Enforce strict role-based access control so that only a small, audited set of operators holds the administrator tag.
- Validate definitions files out-of-band before import and reject any payload containing vhost metadata maps with excessive key counts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.