CVE-2026-67238

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name / routing key beginning amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). binary_to_existing_atom is not used. Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests. Preconditions include Authenticated AMQP 0-9-1 connection to any vhost No per-connection rate limit low enough to make ~1M operations infeasible. This issue is fixed in versions 4.2.7 and 4.3.1.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: HIGH
CVSS score: 7.1 / 10
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Effective score: 7.1 / 10 HIGH source: CNA overview
CWE(s): CWE-400
Reserved: 2026-07-28
Published: 2026-09-23 19:58 UTC
Last updated: 2026-09-23 19:58 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/67xxx/CVE-2026-67238.json
Linked Threat: CVE-2026-67238 — RabbitMQ: Atom-table exhaustion via reply-to queue name decoding

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-23 20:17:13 UTC
NVD last modified: 2026-09-23 20:17:13 UTC

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-85624

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
rabbitmq	rabbitmq-server	`>= 4.2.0, < 4.2.7` (affected), `>= 4.3.0, < 4.3.1` (affected)	—

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x96j-244m-mrr2 x_refsource_CONFIRM
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7 x_refsource_MISC
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1 x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7 security-advisories@github.com
https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1 security-advisories@github.com
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x96j-244m-mrr2 security-advisories@github.com

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft and Adobe Patch Tuesday, August 2026 Security Update Review

web:blog.qualys.com

The August 2026 Microsoft Patch Tuesday release delivers security fixes for vulnerabilities affecting a wide range of Microsoft products and services.

2026-09-24 11:13 UTC
CVE-2026-67238: Rabbitmq Server Vulnerability | CVETodo

web:cvetodo.com

CVE-2026-67238 is a CVSS 7.1 high-severity vulnerability in Rabbitmq Server. Includes technical details, affected versions, and mitigation steps.

2026-09-24 11:13 UTC
CVE-2026-67238 - Exploits & Severity - Feedly

web:feedly.com

News CVE-2026-67238 : CWE-400: Uncontrolled Resource Consumption in rabbitmq rabbitmq-server

2026-09-24 11:13 UTC
CVE-2026-67238: rabbitmq rabbitmq-server vulnerability | Glexia

web:security.glexia.com

CVE-2026-67238 is a High severity, CVSS 7.1. Affecting rabbitmq rabbitmq-server. Review impact, affected versions, remediation priorities, CWE and ATT&CK context.

2026-09-24 11:13 UTC
Description of the security update for Office 2016: August 11, 2026 ...

web:support.microsoft.com

Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016. It doesn't apply to the Office 2016 Click-to-Run editions, such as Microsoft Office 365 Home. (See What version of Office am I using?) How to get and install the update Method 1: Microsoft Update This update is available from Microsoft Update. When you turn on ...

2026-09-24 11:13 UTC
CVE-2026-67238 - RabbitMQ Erlang VM Crash via ETF Parsing…

web:vulmon.com

RabbitMQ Erlang VM Crash via ETF Parsing Vulnerability. Authenticated AMQP clients can crash the entire Erlang VM in RabbitMQ versions prior to 4.2.7 and 4.3.1…

2026-09-24 11:13 UTC
CVE-2026-67238 - vulnerability database | Vulners.com

web:vulners.com

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

2026-09-24 11:13 UTC
CVE-2026-62878: Patch Windows DNS Server RCE Flaw

web:windowsforum.com

Microsoft published CVE - 2026 -62878 on August 11 as a Windows DNS Server Remote Code Execution Vulnerability, putting systems that run the Windows DNS Server role into the immediate patch -and-verify queue.

2026-09-24 11:13 UTC
Oracle Critical Patch Update Advisory - July 2026

web:www.oracle.com

This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.

2026-09-24 11:13 UTC
CVE-2026-67238: rabbitmq rabbitmq-server: RabbitMQ is a ... - Rapid7

web:www.rapid7.com

CVE-2026-67238 : rabbitmq rabbitmq-server: RabbitMQ is a messaging and streaming broker. View severity, references, and remediation details from Rapid7.

2026-09-24 11:13 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-67238.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "rabbitmq-server",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.2.0, < 4.2.7"
            },
            {
              "status": "affected",
              "version": ">= 4.3.0, < 4.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name / routing key beginning amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). binary_to_existing_atom is not used. Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests. Preconditions include Authenticated AMQP 0-9-1 connection to any vhost No per-connection rate limit low enough to make ~1M operations infeasible. This issue is fixed in versions 4.2.7 and 4.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:58:35.019Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x96j-244m-mrr2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x96j-244m-mrr2"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7"
        },
        {
          "name": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-x96j-244m-mrr2",
        "discovery": "UNKNOWN"
      },
      "title": "RabbitMQ: Atom-table exhaustion via reply-to queue name decoding"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-67238",
    "datePublished": "2026-09-23T19:58:35.019Z",
    "dateReserved": "2026-07-28T19:50:39.438Z",
    "dateUpdated": "2026-09-23T19:58:35.019Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}