Описание
Atom table exhaustion via management API node field
Origin
This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.
Impact
Roughly 900K requests crash the VM via system_limit, and all tenants lose service. The crash takes between 30 minutes and 2.5 hours over keep-alive. The management tag is routinely given to application teams, monitoring tools, and similar consumers, so this is a low-privilege remote denial of service.
Description
PUT /api/queues/:vhost/:name (and the exchanges and bindings endpoints) accepts a node JSON field. The value goes through rabbit_nodes:make → list_to_atom with no cluster membership check first. Each unique value permanently leaks one atom.
A March 2026 refactoring (ea61ce2563) introduced safe helpers in rabbit_mgmt_nodes.erl (parse_node_name, safe_atom, and require_node_name, using binary_to_existing_atom) and fixed several callers (QQ replica ops, wm_auth_attempts, wm_node_memory_ets, get_sort_reverse, and rabbit_federation_mgmt), but get_node/1 in rabbit_mgmt_util.erl:880-885, the primary vector used by direct_request/6, was not migrated.
Preconditions
Any user with the management tag and one vhost, the lowest privilege level.
CVSS
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N (6.0, Moderate). Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0.
Пакеты
rabbitmq
>= 3.13.0, < 3.13.15
3.13.15
rabbitmq
>= 4.0.0, < 4.0.20
4.0.20
rabbitmq
>= 4.1.0, < 4.1.11
4.1.11
rabbitmq
>= 4.2.0, < 4.2.6
4.2.6