CVE-2026-66072: RabbitMQ: Atom table exhaustion via stream `chunk_selector`
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, getchunkselector/1 calls binarytoatom on the raw client-supplied <<"chunkselector">> property from post-auth subscribe and resolveoffsetspec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmqstream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 3.13.15 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.0.20 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.1.11 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.6 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated client using the RabbitMQ stream protocol can exploit it if the rabbitmq_stream plugin is enabled and that user has read access to at least one stream. No access beyond stream read permission is stated as necessary.
What is the impact of successful exploitation?
An attacker can exhaust the Erlang atom table by supplying raw chunk_selector values, causing the RabbitMQ broker node to crash.
Are default RabbitMQ deployments affected?
The issue requires the rabbitmq_stream plugin to be enabled and a stream-protocol user with read access to a stream. Deployments without the plugin enabled or without such user access do not meet the listed preconditions.
Which versions contain the fix?
Fixed versions are 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1. Versions earlier than the applicable fixed release are affected.