CVE-2026-67222: RabbitMQ: list_to_atom on auth_mechanism URI tokens in amqp_client
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied listtoatom/1 to every colon-delimited token in an attacker-controlled authmechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a large request. Exploitation requires the Shovel or Federation plugin to be in use, and setting authmechanism requires the policymaker tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 3.13.15 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.0.20 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.1.11 - Upgrade
Upgrade
RabbitMQto a version that resolves this vulnerability.Fixed in 4.2.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires use of the Shovel or Federation plugin. An attacker must also be able to set the auth_mechanism value, which requires the policymaker tag.
What access does an attacker need to crash a node?
The attacker needs policymaker-tag permissions to supply a crafted auth_mechanism value. Colon-delimited tokens in that value can cause permanent Erlang VM atom consumption, allowing a sufficiently large request to crash the node.
Which versions contain the fix?
The issue is fixed in RabbitMQ 3.13.15, 4.0.20, 4.1.11, and 4.2.6.