Vulnerability · Published Sep 25, 2026 · Assigned by GitHub_M
CVE-2026-66073RabbitMQ: Atom table exhaustion via management API node field
Medium 6.0
In plain English
A medium-severity uncontrolled resource consumption in rabbitmq-server from rabbitmq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name (and the exchanges and bindings endpoints) accepts a node JSON field. The value goes through rabbitnodes:make → listtoatom with no cluster membership check first. Each unique value permanently leaks one atom. A March 2026 refactoring (ea61ce2563) introduced safe helpers in rabbitmgmtnodes.erl (parsenodename, safeatom, and requirenodename, using binarytoexistingatom) and fixed several callers (QQ replica ops, wmauthattempts, wmnodememoryets, getsortreverse, and rabbitfederationmgmt), but getnode/1 in rabbitmgmtutil.erl:880-885, the primary vector used by directrequest/6, was not Roughly 900K requests crash the VM via systemlimit, and all tenants lose Any user with the management tag and one vhost, the lowest privilege This issue is fixed in versions 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rabbitmq-server | no fix listed | DEBIAN-CVE-2026-66073 |
| Debian:13 | rabbitmq-server | no fix listed | DEBIAN-CVE-2026-66073 |
| Debian:14 | rabbitmq-server | 4.3.0-2 | DEBIAN-CVE-2026-66073 |
| Ubuntu:22.04:LTS | rabbitmq-server | no fix listed | UBUNTU-CVE-2026-66073 |
| Ubuntu:24.04:LTS | rabbitmq-server | no fix listed | UBUNTU-CVE-2026-66073 |
| Ubuntu:26.04:LTS | rabbitmq-server | no fix listed | UBUNTU-CVE-2026-66073 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rabbitmq | rabbitmq-server | >= 3.13.0, < 3.13.15>= 4.0.0, < 4.0.20>= 4.1.0, < 4.1.11>= 4.2.0, < 4.2.6 |
Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N