CVE-2026-67238

Name	CVE-2026-67238
Description	RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbit_pid_codec:decompose_from_binary/1 parses a caller-supplied ETF-encoded binary and calls binary_to_atom(Node, utf8) on the node-name field. It is reached from rabbit_volatile_queue:pid_from_name/2, which is invoked for any queue name / routing key beginning amq.rabbitmq.reply-to.. The CandidateNodes membership check happens after the atom is created, and the surrounding try/catch cannot reclaim atoms (they are never GC'd). binary_to_existing_atom is not used. Any authenticated AMQP client can crash the entire Erlang VM (all vhosts, all connections) with ~1M cheap requests. Preconditions include Authenticated AMQP 0-9-1 connection to any vhost No per-connection rate limit low enough to make ~1M operations infeasible. This issue is fixed in versions 4.2.7 and 4.3.1.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rabbitmq-server (PTS)	bookworm, bookworm (security)	3.10.8-1.1+deb12u1	fixed
	trixie	4.0.5-6+deb13u2	fixed
	forky, sid	4.3.2-4	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
rabbitmq-server	source	bookworm	(not affected)
rabbitmq-server	source	trixie	(not affected)
rabbitmq-server	source	(unstable)	(unfixed)

Notes

[trixie] - rabbitmq-server <not-affected> (Vulnerable code not present, only affects 4.2 and later)
[bookworm] - rabbitmq-server <not-affected> (Vulnerable code not present, only affects 4.2 and later)
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x96j-244m-mrr2