CVE-2026-67222

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6

Description An issue exists where the mechanisms/1 function applies list to atom/1 to every colon-delimited token within an attacker-controlled auth mechanism value. This leads to the permanent consumption of Erlang VM atoms, which can cause the node to crash when processing a large request. Exploitation of this issue requires the Shovel or Federation plugin to be active and the user to possess the policymaker tag to set the auth mechanism value.

Recommendations Update RabbitMQ to version 3.13.15. Update RabbitMQ to version 4.0.20. Update RabbitMQ to version 4.1.11. Update RabbitMQ to version 4.2.6.