Is CVE-2026-67238 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67238 being exploited in the wild.

How severe is CVE-2026-67238?

Informational severity, published 23 September 2026.

Which products and versions are affected?

VMware RabbitMQ before 4.2.7 and before 4.3.1.

Is there a fix for CVE-2026-67238?

A patch was published on 2026-05-19: Fixed in RabbitMQ 4.2.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67238 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-67238?

Check whether you run VMware RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67238: RabbitMQ atom memory leak denial of service

CVE-2026-67238 · Severity: info · Published 2026-09-23

RabbitMQ is a messaging broker that handles message routing between applications. An authenticated user can crash the entire RabbitMQ server by sending specially crafted messages with malformed queue names, causing memory exhaustion in the Erlang runtime that never recovers. This disrupts all messaging for every virtual host and user connected to the broker.

Technologies: VMware RabbitMQ. Vendors: VMware.

Quick answers

Is CVE-2026-67238 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67238 being exploited in the wild.
How severe is CVE-2026-67238?: Informational severity, published 23 September 2026.
Which products and versions are affected?: VMware RabbitMQ before 4.2.7 and before 4.3.1.
Is there a fix for CVE-2026-67238?: A patch was published on 2026-05-19: Fixed in RabbitMQ 4.2.7 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67238 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-67238?: Check whether you run VMware RabbitMQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The rabbit_pid_codec:decompose_from_binary/1 function unsafely converts an untrusted node-name field from ETF-encoded binary to an atom via binary_to_atom(Node, utf8), creating atoms that cannot be garbage-collected in Erlang. An authenticated AMQP 0-9-1 client can trigger this via queue names beginning with amq.rabbitmq.reply-to., exhausting the atom table and crashing the VM with approximately 1 million requests. The vulnerability requires authentication but no per-connection rate limiting adequate to prevent exploitation.

Affected products

VMware RabbitMQ before 4.2.7 and before 4.3.1

Timeline

2026-09-23: disclosed: CVE-2026-67238 published
2026-05-19: patched: Fixed in RabbitMQ 4.2.7
2026-05-20: patched: Fixed in RabbitMQ 4.3.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.