Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbit/src/rabbit_auth_backend_internal.erl:853 · Atom Table Exhaustion
Impact
An administrator can crash the node in a single request by creating a user (or importing definitions) with ~1M unique tag strings.
Description
set_tags/2 maps rabbit_data_coercion:to_atom/1 over the user's tags list. The 20 MB management body limit fits ~3-4M short tag strings. Admin-only.
Exploit scenario
PUT /api/users/x body {"password":"x","tags":"t0000001,t0000002,...,t3000000"}. VM aborts.
Preconditions
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (6.9, Moderate). Fixed in 4.0.22, 4.1.14, 4.2.7, 4.3.0.
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Source references
deps/rabbit/src/rabbit_auth_backend_internal.erl:853· Atom Table ExhaustionImpact
An administrator can crash the node in a single request by creating a user (or importing definitions) with ~1M unique tag strings.
Description
set_tags/2 maps rabbit_data_coercion:to_atom/1 over the user's tags list. The 20 MB management body limit fits ~3-4M short tag strings. Admin-only.
Exploit scenario
PUT /api/users/x body {"password":"x","tags":"t0000001,t0000002,...,t3000000"}. VM aborts.
Preconditions
CVSS
CVSS v4.0:
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N(6.9, Moderate). Fixed in4.0.22,4.1.14,4.2.7,4.3.0.