Vulnerability Details CVE-2026-67222
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied list_to_atom/1 to every colon-delimited token in an attacker-controlled auth_mechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a large request. Exploitation requires the Shovel or Federation plugin to be in use, and setting auth_mechanism requires the policymaker tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 22.2%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2026-67222
-
cpe:2.3:a:broadcom:rabbitmq_server:3.13.0
-
cpe:2.3:a:broadcom:rabbitmq_server:3.13.1
-
cpe:2.3:a:broadcom:rabbitmq_server:3.13.2
-
cpe:2.3:a:broadcom:rabbitmq_server:3.13.3
-
cpe:2.3:a:broadcom:rabbitmq_server:3.13.4
-
cpe:2.3:a:broadcom:rabbitmq_server:3.13.5
-
cpe:2.3:a:broadcom:rabbitmq_server:3.13.6
-
cpe:2.3:a:broadcom:rabbitmq_server:3.13.7
-
cpe:2.3:a:broadcom:rabbitmq_server:3.13.9
-
cpe:2.3:a:broadcom:rabbitmq_server:4.1.0
-
cpe:2.3:a:broadcom:rabbitmq_server:4.1.1
-
cpe:2.3:a:broadcom:rabbitmq_server:4.1.2
-
cpe:2.3:a:broadcom:rabbitmq_server:4.1.3
-
cpe:2.3:a:broadcom:rabbitmq_server:4.1.4
-
cpe:2.3:a:broadcom:rabbitmq_server:4.1.5
-
cpe:2.3:a:broadcom:rabbitmq_server:4.1.6
-
cpe:2.3:a:broadcom:rabbitmq_server:4.1.7
-
cpe:2.3:a:broadcom:rabbitmq_server:4.1.8