CVE-2026-67227 rabbitmq CVE debrief

Who should care

RabbitMQ administrators and users with the policymaker tag should assess exposure and prioritize patching. This includes reviewing RabbitMQ versions and access controls for policymaker users. Defenders should also verify the management plugin configuration and limit access to the /api/global-parameters/:name endpoint. Additionally, monitoring for unusual activity and implementing compensating controls may be necessary.

Why it matters

Defenders should care about CVE-2026-67227 because it allows a policymaker user to crash the RabbitMQ node, potentially causing denial of service. Affected versions require patching to prevent exploitation.

• Crash of RabbitMQ node due to atom table exhaustion
• Potential denial of service for RabbitMQ users
• Verification of RabbitMQ version and policymaker user access controls required

Technical summary

The RabbitMQ messaging and streaming broker is vulnerable to atom exhaustion through the /api/global-parameters/:name endpoint. A policymaker user can exploit this vulnerability to crash the node by making repeated requests with unique :name values. This issue arises from the toatom/1 function using binarytoatom/2, an unsafe operation. The vulnerability requires the policymaker tag and involves the management plugin. Affected versions include 4.0.0 through 4.0.21, 4.1.0 through 4.1.13, 4.2.0 through 4.2.6, and 4.3.0. The issue is fixed in versions 4.0.22, 4.1.14, 4.2.7, and 4.3.1.

Defensive priority

Defenders should prioritize patching RabbitMQ versions 4.0.0 through 4.0.21, 4.1.0 through 4.1.13, 4.2.0 through 4.2.6, and 4.3.0.

Recommended defensive actions

• Patch RabbitMQ to version 4.0.22 or later
• Patch RabbitMQ to version 4.1.14 or later
• Patch RabbitMQ to version 4.2.7 or later
• Patch RabbitMQ to version 4.3.1 or later
• Restrict access to the policymaker tag

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but do not specify any instances of exploitation. The vulnerability affects RabbitMQ versions 4.0.0 through 4.0.21, 4.1.0 through 4.1.13, 4.2.0 through 4.2.6, and 4.3.0. There is no evidence of in-the-wild exploitation. Defenders should verify the RabbitMQ version and policymaker user access controls.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.