CVE-2026-67234

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.2.0 through 4.2.7 RabbitMQ versions 4.3.0 through 4.3.1

Description The get auth mechanism/1 function uses term to binary/1 on the strict auth mechanism or preferred auth mechanism atom when clearing cookies. This process generates a non-ASCII cookie name that violates RFC 6265, which may prevent the browser from deleting the preference. This results in stale authentication-mechanism preferences persisting across logout and login cycles.

Recommendations Update to version 4.2.8. Update to version 4.3.2.