CVE-2026-66071

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x through 4.0.21 RabbitMQ versions 4.1.x through 4.1.10 RabbitMQ versions 4.2.x through 4.2.5 RabbitMQ versions 4.3.x through 4.3.0

Description An atom exhaustion issue exists when the rabbitmqauthbackendoauth2 is enabled and the Identity Provider (IdP) allows user-influenced scope values in signed tokens. The extractscopes/1 function parses scopes formatted as .tag: and utilizes the rabbitdatacoercion:toatom() function to convert them into tag atoms. While token signatures are verified to prevent forgery, an attacker capable of influencing scope content can cause the system to leak resources by logging in with novel tag values.

Recommendations Update to version 3.13.15 Update to version 4.0.22 Update to version 4.1.11 Update to version 4.2.6 Update to version 4.3.1