---
id: CVE-2026-66073
title: RabbitMQ is a messaging and streaming broker
summary: >-
  RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and
  4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node
  field. pUT /api/queues/:vhost/:name (and the exchanges and bindings endpoints)
  accepts…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-770
vendor: broadcom
product: rabbitmq_server
affected:
  - 'rabbitmq_server >= 3.13.0, < 3.13.15'
  - 'rabbitmq_server >= 4.0.0, < 4.0.20'
  - 'rabbitmq_server >= 4.1.0, < 4.1.11'
  - 'rabbitmq_server >= 4.2.0, < 4.2.6'
patched:
  - rabbitmq_server 4.2.6
published: '2026-09-25'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T15:29:11.363'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66073'
references:
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/commit/7f64311471840e68f8cae09e4d4fdc4c8aca9229
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6'
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-6v53-r759-jrvx
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66073.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-66073'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541508'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-66073'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-66073'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67552'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00471
epssPercentile: 0.40842
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-25T16:43:02.733440Z'
scores:
  nvd: 6.5
  cna: 6
  vendor: 6.5
ingestedAt: '2026-09-25T17:13:14.017Z'
---

## Overview

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name (and the exchanges and bindings endpoints) accepts a node JSON field. The value goes through rabbitnodes:make → listtoatom with no cluster membership check first. Each unique value permanently leaks one atom. A March 2026 refactoring (ea61ce2563) introduced safe helpers in rabbitmgmtnodes.erl (parsenodename, safeatom, and requirenodename, using binarytoexistingatom) and fixed several callers (QQ replica ops, wmauthattempts, wmnodememoryets, getsortreverse, and rabbitfederationmgmt), but getnode/1 in rabbitmgmtutil.erl:880-885, the primary vector used by directrequest/6, was not Roughly 900K requests crash the VM via systemlimit, and all tenants lose Any user with the management tag and one vhost, the lowest privilege This issue is fixed in versions 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6.

## Affected

- `rabbitmq_server >= 3.13.0, < 3.13.15`
- `rabbitmq_server >= 4.0.0, < 4.0.20`
- `rabbitmq_server >= 4.1.0, < 4.1.11`
- `rabbitmq_server >= 4.2.0, < 4.2.6`

## Remediation

Upgrade past the affected range:

- `rabbitmq_server 4.2.6`

## Vendor advisories

- **RHSA-2026:67552** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67552)
- **Red Hat VEX** · Moderate · affected: Red Hat Hardened Images, Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 · no fix planned: Red Hat OpenStack Platform 13 (Queens), Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat Hardened Images, … · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-66073.json)