CVE-2026-67415

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2

Description The Shovel parameter parser converts attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking a fixed allowlist. Erlang atoms are constants whose names cannot be changed and are not reclaimed by the garbage collector. An attacker with network access to the Management HTTP API, valid credentials with management and policymaker tags, permission to set Shovel runtime parameters on a vhost, and the rabbitmq shovel and rabbitmq shovel management plugins enabled can exhaust the node-wide atom table. This leads to a denial of service. Because malicious parameters are stored durably and reparsed when workers start, the atom pressure can recur after a restart even without an active attacker connection.

Recommendations Update to version 4.2.9. Update to version 4.3.3.