Skip to content

Admin-only atom exhaustion: PUT /api/users tags list

Moderate
michaelklishin published GHSA-34c7-r8w9-5wv8 Jul 23, 2026

Software

rabbitmq-server

Affected versions

>= 4.0.0, < 4.0.22
>= 4.1.0, < 4.1.14
>= 4.2.0, < 4.2.7

Patched versions

4.0.22
4.1.14
4.2.7

Description

Origin

This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.

Source references

deps/rabbit/src/rabbit_auth_backend_internal.erl:853 · Atom Table Exhaustion

Impact

An administrator can crash the node in a single request by creating a user (or importing definitions) with ~1M unique tag strings.

Description

set_tags/2 maps rabbit_data_coercion:to_atom/1 over the user's tags list. The 20 MB management body limit fits ~3-4M short tag strings. Admin-only.

Exploit scenario

PUT /api/users/x body {"password":"x","tags":"t0000001,t0000002,...,t3000000"}. VM aborts.

Preconditions

  • administrator tag

CVSS

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (6.9, Moderate). Fixed in 4.0.22, 4.1.14, 4.2.7, 4.3.0.

Severity

Moderate

CVE ID

No known CVE

Weaknesses

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource. Learn more on MITRE.