# CVE-2026-67227: RabbitMQ atom exhaustion in global parameters API

Source: https://junglewise.ai/threats/cve-2026-67227-rabbitmq-is-a-messaging-and-streaming-broker-from-4-0-0-until-4-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-67227 · Severity: info · Published 2026-09-25

RabbitMQ is a messaging broker used to queue and route data between applications. A user with limited administrative permissions (policymaker role) can crash the RabbitMQ server by making many requests to the global parameters HTTP API with unique parameter names, exhausting the server's atom table until it runs out of memory. The attack requires administrative access and the management plugin to be enabled.

Technologies: [RabbitMQ](https://junglewise.ai/threats/technologies/rabbitmq-rabbitmq). Vendors: [RabbitMQ](https://junglewise.ai/threats/vendors/rabbitmq).

## Quick answers

**Is CVE-2026-67227 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67227 being exploited in the wild.

**How severe is CVE-2026-67227?** Informational severity, published 25 September 2026.

**Which products and versions are affected?** RabbitMQ 4.0.0 to 4.0.21, 4.1.0 to 4.1.13, 4.2.0 to 4.2.6, 4.3.0.

**Is there a fix for CVE-2026-67227?** A patch was published on 2026-04-28: Fix applied in versions 4.0.22, 4.1.14, 4.2.7, 4.3.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67227 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-67227?** Check whether you run RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the HTTP API handler for global parameters, which unsafely converts URL path segments to atoms using Erlang's binary_to_atom/2 function. The endpoint /api/global-parameters/:name in the PUT and DELETE handlers passes the :name segment to rabbitdatacoercion:toatom/1, which creates a new atom for each unique name. Repeated requests with different parameter names exhaust the finite atom table, causing a crash. Only users with the policymaker role can trigger this, and patched versions (4.0.22, 4.1.14, 4.2.7, 4.3.1 and later) refactor the code to avoid unsafe atom creation.

## Affected products

- RabbitMQ RabbitMQ 4.0.0 to 4.0.21, 4.1.0 to 4.1.13, 4.2.0 to 4.2.6, 4.3.0

## Timeline

- 2026-09-25: disclosed
- 2026-04-28: patched: Fix applied in versions 4.0.22, 4.1.14, 4.2.7, 4.3.1

## References

- [https://github.com/rabbitmq/rabbitmq-server/commit/8fbe6d8112427e85fb9a9206b3eb6e9a3ddd3e39](https://github.com/rabbitmq/rabbitmq-server/commit/8fbe6d8112427e85fb9a9206b3eb6e9a3ddd3e39)
- [https://github.com/rabbitmq/rabbitmq-server/commit/fc591e7ee27a29657ca960930acefd3e4217e007](https://github.com/rabbitmq/rabbitmq-server/commit/fc591e7ee27a29657ca960930acefd3e4217e007)

## Related threats

- [RabbitMQ OAuth privilege escalation via stale token tags](https://junglewise.ai/threats/cve-2026-67420-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3)
- [RabbitMQ topic exchange denial of service via duplicate matchers](https://junglewise.ai/threats/cve-2026-67419-rabbitmq-is-a-messaging-and-streaming-broker-prior-to-4-3-5-an)
- [RabbitMQ Shovel denial of service via atom exhaustion](https://junglewise.ai/threats/cve-2026-67415-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-2)
- [RabbitMQ MQTT loopback user bypass via PROXY Protocol](https://junglewise.ai/threats/cve-2026-67411-rabbitmq-is-a-messaging-and-streaming-broker-from-3-13-0-until-3)
- [RabbitMQ OAuth2 client secret exposure via unauthenticated endpoint](https://junglewise.ai/threats/cve-2026-67410-rabbitmq-is-a-messaging-and-streaming-broker-from-4-2-0-until-4-3)