CVE-2026-66073Medium· 6.5▾ SunlitRabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name (and the exchanges and bindings endpoints) accepts…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
6 → 6.5
0.3% → 0.5%
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name (and the exchanges and bindings endpoints) accepts a node JSON field. The value goes through rabbitnodes:make → listtoatom with no cluster membership check first. Each unique value permanently leaks one atom. A March 2026 refactoring (ea61ce2563) introduced safe helpers in rabbitmgmtnodes.erl (parsenodename, safeatom, and requirenodename, using binarytoexistingatom) and fixed several callers (QQ replica ops, wmauthattempts, wmnodememoryets, getsortreverse, and rabbitfederationmgmt), but getnode/1 in rabbitmgmtutil.erl:880-885, the primary vector used by directrequest/6, was not Roughly 900K requests crash the VM via systemlimit, and all tenants lose Any user with the management tag and one vhost, the lowest privilege This issue is fixed in versions 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6.
rabbitmq_server >= 3.13.0, < 3.13.15rabbitmq_server >= 4.0.0, < 4.0.20rabbitmq_server >= 4.1.0, < 4.1.11rabbitmq_server >= 4.2.0, < 4.2.6Upgrade past the affected range:
rabbitmq_server 4.2.6Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67222Medium· 6.5RabbitMQ is a messaging and streaming broker
CVE-2026-66071Medium· 6.5RabbitMQ is a messaging and streaming broker
CVE-2026-67415Medium· 4.9RabbitMQ is a messaging and streaming broker
CVE-2026-66078Medium· 5.5RabbitMQ is a messaging and streaming broker
CVE-2026-67408Medium· 6.5RabbitMQ is a messaging and streaming broker
CVE-2026-67223High· 7.1RabbitMQ is a messaging and streaming broker