# CVE-2026-66071: RabbitMQ atom exhaustion in OAuth2 JWT scope parsing

Source: https://junglewise.ai/threats/cve-2026-66071-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-66071 · Severity: info · Published 2026-09-25

RabbitMQ is a message broker used for event streaming and application communication. When OAuth2 authentication is configured with an identity provider that allows user-influenced scope values in signed tokens, an attacker can exhaust Erlang atoms—limited system resources—by submitting logins with novel scope values, potentially causing a denial of service. The vulnerability requires the IdP to permit attacker-influenced scopes in signed tokens.

Technologies: [VMware RabbitMQ](https://junglewise.ai/threats/technologies/vmware-rabbitmq). Vendors: [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-66071 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-66071 being exploited in the wild.

**How severe is CVE-2026-66071?** Informational severity, published 25 September 2026.

**Which products and versions are affected?** VMware RabbitMQ 3.13.0 until 3.13.15, 4.0.x until 4.0.22, 4.1.x until 4.1.11, 4.2.x until 4.2.6, 4.3.0 until 4.3.1.

**Is there a fix for CVE-2026-66071?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-66071 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-66071?** Check whether you run VMware RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The OAuth2 authentication backend parses JWT scope claims of the form "tag:value" and converts them to Erlang atoms using rabbitdatacoercion:toatom(), without limiting the number of scopes allowed. Although the JWT signature is verified, if the IdP configuration permits user-influenced scope values in signed tokens, an attacker can trigger creation of arbitrary atoms by logging in repeatedly with novel tag values, exhausting the fixed pool of Erlang atoms and causing a denial of service. The fix limits the number of scopes to 2048 per token.

## Affected products

- VMware RabbitMQ 3.13.0 until 3.13.15, 4.0.x until 4.0.22, 4.1.x until 4.1.11, 4.2.x until 4.2.6, 4.3.0 until 4.3.1

## Timeline

- 2026-09-25: disclosed

## References

- [https://github.com/rabbitmq/rabbitmq-server/commit/9a44124d9c932d6fc7d2a3b945e5a143e547bcb6](https://github.com/rabbitmq/rabbitmq-server/commit/9a44124d9c932d6fc7d2a3b945e5a143e547bcb6)
- [https://github.com/rabbitmq/rabbitmq-server/commit/c5690583a53789a3bf00cca508b43e8246db0d11](https://github.com/rabbitmq/rabbitmq-server/commit/c5690583a53789a3bf00cca508b43e8246db0d11)

## Related threats

- [RabbitMQ MQTT 5 parser invalid property denial of service](https://junglewise.ai/threats/cve-2026-67418-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3)
- [RabbitMQ AMQP 1.0 parser descriptor validation bypass](https://junglewise.ai/threats/cve-2026-67416-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0)
- [RabbitMQ AMQP 1.0 parser memory exhaustion](https://junglewise.ai/threats/cve-2026-67414-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0)
- [RabbitMQ Management XSS via queue name in OAuth UI](https://junglewise.ai/threats/cve-2026-67421-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3)
- [RabbitMQ JMS topic exchange denial of service via regex wildcard expansion](https://junglewise.ai/threats/cve-2026-67413-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0)