This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-67226 →

DEBIAN-CVE-2026-67226

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. sett...

Original description

The description as published by the source.

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits ~3-4M short tag strings. An administrator can crash the node in a single request by creating a user (or importing definitions) with ~1M unique tag administrator. This issue is fixed in versions 4.0.22 and 4.1.14 and 4.2.7.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 rabbitmq-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 rabbitmq-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 rabbitmq-server

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-2"}]}]

References

advisory security-tracker.debian.org