RabbitMQ up to 4.2.6/4.3.0 Runtime Parameter Lookup rabbit_runtime_parameters.erl lookup_component Component denial of service

Summaryinfo

A vulnerability was found in RabbitMQ up to 4.2.6/4.3.0. It has been declared as problematic. This issue affects the function lookup_component of the file deps/rabbit/src/rabbit_runtime_parameters.erl of the component Runtime Parameter Lookup. Such manipulation of the argument Component leads to denial of service. This vulnerability is documented as CVE-2026-67228. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in RabbitMQ up to 4.2.6/4.3.0 and classified as problematic. Affected by this issue is the function lookup_component of the file deps/rabbit/src/rabbit_runtime_parameters.erl of the component Runtime Parameter Lookup. The manipulation of the argument component with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. CVE summarizes:

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbit_data_coercion:to_atom/1 in lookup_component/1 (deps/rabbit/src/rabbit_runtime_parameters.erl), creating a new atom for any previously unseen value. A safe helper, rabbit_registry:binary_to_type/1, which uses binary_to_existing_atom with a catch, already exists but is not used at this call site. lookup_component/1 calls rabbit_data_coercion:to_atom(Component) on the :component segment of the request URL, converting an attacker-supplied string into a new atom. Because the Erlang atom table is bounded and atoms are never garbage collected, an authorized policymaker issuing roughly one million requests with distinct component values can exhaust the atom table and crash the node, resulting in a denial of service. Preconditions include Exploitation requires policymaker privileges and roughly one million requests.. This issue is fixed in versions 4.2.7 and 4.3.1.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-67228 since 07/28/2026. The exploitation is known to be easy. The attack may be launched remotely. The exploitation needs additional levels of successful authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1499 by the MITRE ATT&CK project.

Upgrading to version 4.2.7 or 4.3.1 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• RabbitMQ

Version

• 4.0
• 4.1
• 4.2
• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5
• 4.2.6
• 4.3.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion