CVE-2026-67226
— UNSCOREDpublic exploit availablePublished 2026-09-25 · Updated 2026-09-28
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits ~3-4M short tag strings. An administrator can crash the node in a single request by creating a user (or importing definitions) with ~1M unique tag administrator. This issue is fixed in versions 4.0.22 and 4.1.14 and 4.2.7.
Weaknesses
CWE-400
Public exploit & PoC references
- https://github.com/rabbitmq/rabbitmq-server/commit/86601c5a6d1c7e41060e3dbd165c88bdc91266ee
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-34c7-r8w9-5wv8
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-34c7-r8w9-5wv8
All references
- https://github.com/rabbitmq/rabbitmq-server/commit/86601c5a6d1c7e41060e3dbd165c88bdc91266ee
- https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.7
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-34c7-r8w9-5wv8
- https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-34c7-r8w9-5wv8
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-100242PoC
- MEDIUMCVE-2026-100527PoC
- LOWCVE-2026-100542PoC
- HIGHCVE-2026-100558PoC
- MEDIUMCVE-2026-100571PoC
- MEDIUMCVE-2026-100572PoC
- MEDIUMCVE-2026-100648PoC
- MEDIUMCVE-2026-100650PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.