CVE-2026-66072
RabbitMQ: Atom table exhaustion via stream `chunk_selector`
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
RabbitMQ: Atom table exhaustion via stream `chunk_selector`
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
- Record
CVE-2026-66072- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-85634
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
- Record
EUVD-2026-85634- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
- Record
CVE-2026-66072- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
RabbitMQ: Atom table exhaustion via stream `chunk_selector`
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
- Record
CVE-2026-66072- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-66072
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
- Record
DEBIAN-CVE-2026-66072- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:67552
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:67552- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-66072
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
- Record
UBUNTU-CVE-2026-66072- CVSS 4.0
- 6.0 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-105786 No score
CVE-2026-66072 affecting package rabbitmq-server for versions less than 3.13.7-10
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
- Record
AZL-105786- Updated
- 2026-11-05
OSVBIT-rabbitmq-2026-66072 No score
RabbitMQ: Atom table exhaustion via stream `chunk_selector`
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, get_chunk_selector/1 calls binary_to_atom on the raw client-supplied <<"chunk_selector">> property from post-auth subscribe and resolve_offset_spec frames, with no whitelist and no existing guard. An authenticated stream client with read access to any stream can crash the broker node. Preconditions include rabbitmq_stream plugin enabled Authenticated stream-protocol user with read access to at least one stream. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1.
- Record
BIT-rabbitmq-2026-66072- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rabbitmq-serverAzure Linux:3 |
before 3.13.7-10 | 3.13.7-10 |
rabbitmqBitnami |
3.13.0 up to 3.13.15, 4.0.0 up to 4.0.20, 4.1.0 up to 4.1.11, 4.2.0 up to 4.2.6, 4.3.0 up to 4.3.1 | 3.13.154.0.204.1.114.2.64.3.1 |
rabbitmq-serverDebian:12 |
All versions, plus listed versions 3.10.8-1.13.10.8-1.1+deb12u13.10.8-23.10.8-33.10.8-4 Show 24 moreShow less3.12.1-13.12.1-1.14.0.5-14.0.5-104.0.5-114.0.5-124.0.5-134.0.5-144.0.5-24.0.5-34.0.5-44.0.5-54.0.5-64.0.5-84.0.5-94.3.0-14.3.0-24.3.0-34.3.2-14.3.2-24.3.2-34.3.2-44.3.2-54.3.6-1 |
None known |
rabbitmq-serverDebian:13 |
All versions, plus listed versions 4.0.5-104.0.5-114.0.5-124.0.5-134.0.5-14 Show 14 moreShow less4.0.5-64.0.5-6+deb13u14.0.5-6+deb13u24.0.5-84.0.5-94.3.0-14.3.0-24.3.0-34.3.2-14.3.2-24.3.2-34.3.2-44.3.2-54.3.6-1 |
None known |
rabbitmq-serverDebian:14 |
before 4.3.2-1, plus listed versions 4.0.5-104.0.5-114.0.5-124.0.5-134.0.5-14 Show 6 moreShow less4.0.5-64.0.5-84.0.5-94.3.0-14.3.0-24.3.0-3 |
4.3.2-1 |
rabbitmq-server4.3Red Hat:hummingbird:1 From an advisory covering 54 CVEs |
before 0:4.3.6-1.hum1 | 0:4.3.6-1.hum1 |
rabbitmq-serverUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.5.4-13.5.4-33.5.4-3.13.5.7-13.5.7-1ubuntu0.16.04.1 Show 5 moreShow less3.5.7-1ubuntu0.16.04.23.5.7-1ubuntu0.16.04.43.5.7-1ubuntu0.16.04.4+esm13.5.7-1ubuntu0.16.04.4+esm23.5.7-1ubuntu0.16.04.4+esm3 |
None known |
rabbitmq-serverUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.6.10-13.6.10-1ubuntu0.13.6.10-1ubuntu0.33.6.10-1ubuntu0.43.6.10-1ubuntu0.53.6.10-1ubuntu0.5+esm1 |
None known |
rabbitmq-serverUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.7.8-4ubuntu23.7.18-13.8.2-0ubuntu13.8.2-0ubuntu1.13.8.2-0ubuntu1.2 Show 8 moreShow less3.8.2-0ubuntu1.33.8.2-0ubuntu1.43.8.2-0ubuntu1.53.8.3-0ubuntu0.13.8.3-0ubuntu0.23.8.3-0ubuntu0.33.8.3-0ubuntu0.3+esm13.8.3-0ubuntu0.3+esm2 |
None known |
rabbitmq-serverUbuntu:22.04:LTS |
All versions, plus listed versions 3.8.9-3ubuntu13.9.8-13.9.8-23.9.8-33.9.8-5 Show 8 moreShow less3.9.8-63.9.13-13.9.13-1ubuntu0.22.04.13.9.13-1ubuntu0.22.04.23.9.27-0ubuntu0.13.9.27-0ubuntu0.23.9.27-0ubuntu0.53.9.27-0ubuntu0.6 |
None known |
rabbitmq-serverUbuntu:24.04:LTS |
All versions, plus listed versions 3.12.1-13.12.1-1ubuntu13.12.1-1ubuntu1.23.12.1-1ubuntu1.43.12.1-1ubuntu1.63.12.1-1ubuntu1.7 |
None known |
rabbitmq-serverUbuntu:26.04:LTS |
All versions, plus listed versions 4.0.5-8ubuntu24.0.5-10ubuntu14.0.5-10ubuntu24.0.5-10ubuntu34.0.5-10ubuntu44.0.5-10ubuntu54.0.5-10ubuntu5.14.0.5-10ubuntu5.2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-66072 is a medium vulnerability (CVSS 6.0) in Broadcom Rabbitmq Server, published September 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in rabbitmq-server 3.13.7-10.
References
github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-48hm-chgv-398r
nvd.nist.gov/vuln/detail/CVE-2026-66072
security-tracker.debian.org/tracker/CVE-2026-66072
Show 194 moreShow less
access.redhat.com/errata/RHSA-2026:67552
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67552.json
bugzilla.redhat.com/show_bug.cgi?id=2482215
cve.org/CVERecord?id=CVE-2026-44839
ubuntu.com/security/CVE-2026-66072
Left out here: 124 references. The JSON record has them.