CVE-2026-67222 rabbitmq CVE debrief

Who should care

RabbitMQ administrators and users with the Shovel or Federation plugin enabled and the policymaker tag set should assess exposure and prioritize patching. They should also verify their configurations, monitor for large auth_mechanism requests, and review compensating controls for exposed systems.

Why it matters

CVE-2026-67222 is a medium-severity vulnerability in RabbitMQ that can cause node crashes and Erlang VM atom exhaustion. Defenders should prioritize patching, especially for Shovel or Federation plugin users with the policymaker tag set.

• Potential for denial of service (DoS) via node crash
• Erlang VM atom exhaustion requires verification
• Large auth_mechanism requests require monitoring
• Patching priority for Shovel or Federation plugin users

Technical summary

The vulnerability is caused by mechanisms/1 applying list_to_atom/1 to every colon-delimited token in an attacker-controlled auth_mechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a large request. This issue requires the Shovel or Federation plugin to be in use and setting auth_mechanism requires the policymaker tag. The vulnerability can cause node crashes and Erlang VM atom exhaustion, leading to potential denial of service (DoS). Defenders should prioritize patching RabbitMQ instances, especially those with the Shovel or Federation plugin enabled and the policymaker tag set.

Defensive priority

Defenders should prioritize patching RabbitMQ instances, especially those with the Shovel or Federation plugin enabled and the policymaker tag set.

Recommended defensive actions

• Patch RabbitMQ instances to versions 3.13.15, 4.0.20, 4.1.11, or 4.2.6
• Verify Shovel or Federation plugin usage and policymaker tag settings
• Monitor for large auth_mechanism requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including affected versions and fixed versions. The vulnerability allows for potential denial of service (DoS) via node crash and Erlang VM atom exhaustion. The Shovel or Federation plugin users with the policymaker tag set should verify their configurations and monitor for large auth_mechanism requests.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.