All vulnerabilities
CVE-2026-67226GHSA-34c7-r8w9-5wv8

rabbitmq-server: RabbitMQ: Admin-only atom exhaustion: PUT /api/users tags list

rabbitmq rabbitmq-server
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 25 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.0.22Also 4.1.14, 4.2.7GitHub
Published25 Sep 2026Updated 25 Sep 2026CVE List

What fixes it

  • 4.0.22rabbitmq-server, otherGitHub
  • 4.1.14rabbitmq-server, otherGitHub
  • 4.2.7rabbitmq-server, otherGitHub

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits ~3-4M short tag strings. An administrator can crash the node in a single request by creating a user (or importing definitions) with ~1M unique tag administrator. This issue is fixed in versions 4.0.22 and 4.1.14 and 4.2.7.

Text from CVE List

Affected versions 6

  • rabbitmq-serveraffected: >= 4.0.0, < 4.0.22CVE List
  • rabbitmq-serveraffected: >= 4.1.0, < 4.1.14CVE List
  • rabbitmq-serveraffected: >= 4.2.0, < 4.2.7CVE List
  • rabbitmq-server, other>= 4.0.0, < 4.0.22GitHub
  • rabbitmq-server, other>= 4.1.0, < 4.1.14GitHub
  • rabbitmq-server, other>= 4.2.0, < 4.2.7GitHub

References 3