CVE-2026-66072

RabbitMQ: Atom table exhaustion via stream `chunk_selector`

State: Published
Severity: 6.0 Medium
Published: Sep 23, 2026
Updated: Sep 24, 2026
Reserved: Jul 23, 2026

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.

Scores

CVSS	Score	Vector	Source
4.0	6.0 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
rabbitmq-serverrabbitmq	>= 3.13.0, < 3.13.15Affected >= 4.0.0, < 4.0.20Affected >= 4.1.0, < 4.1.11Affected >= 4.2.0, < 4.2.6Affected >= 4.3.0, < 4.3.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.