PT-2026-98907

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.0.0 through 4.0.21 RabbitMQ versions 4.1.x prior to 4.1.14 RabbitMQ versions 4.2.x prior to 4.2.7 Description An administrator can cause a node crash via a single request by creating a user or importing definitions containi...

PT-2026-98908

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.0.0 through 4.0.21 RabbitMQ versions 4.1.x prior to 4.1.14 RabbitMQ versions 4.2.x prior to 4.2.7 RabbitMQ versions 4.3.x prior to 4.3.1 Description An atom exhaustion issue exists when the Management plugin is enabled. A...

Linux Distros Unpatched Vulnerability : CVE-2026-67226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps...

Linux Distros Unpatched Vulnerability : CVE-2026-67227

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter :name...

Linux Distros Unpatched Vulnerability : CVE-2026-66071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values...

Linux Distros Unpatched Vulnerability : CVE-2026-66073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pU...

PT-2026-98902

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x through 4.0.19 RabbitMQ versions 4.1.x through 4.1.10 RabbitMQ versions 4.2.x through 4.2.5 Description An atom table exhaustion issue exists in the management API. The PUT...

PT-2026-98923

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2 Description The Shovel parameter parser converts attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking ...

PT-2026-98901

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x through 4.0.21 RabbitMQ versions 4.1.x through 4.1.10 RabbitMQ versions 4.2.x through 4.2.5 RabbitMQ versions 4.3.x through 4.3.0 Description An atom exhaustion issue exists when...

CVE-2026-67226: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits 3-4M short tag strings. An administrator can...

SUSE CVE-2026-67228

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbitdatacoercion:toatom/1 in lookupcomponent/1 deps/rabbit/src/rabbitruntimeparameters.erl, creating a new atom for any previous...

SUSE CVE-2026-67229

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addvhost/2 calls rabbitdatacoercion:atomizekeys/1 the unsafe variant using binarytoatom on the vhost metadata map. The 20 MB management body limit fits 1M+ short keys. Admin-only. An...

CVE-2026-67238

A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated AMQP Advanced Message Queuing Protocol client can trigger an atom-table exhaustion by sending specially crafted reply-to queue names for decoding. This can lead to the entire Erlang Virtual Machine VM crashing,...

CVE-2026-67229

A flaw was found in RabbitMQ, a messaging and streaming broker. An administrator with appropriate privileges can trigger a Denial of Service DoS by importing a specially crafted definitions file. This file, containing a large number of unique metadata keys, causes the system to exhaust its atom...

CVE-2026-67228

A flaw was found in RabbitMQ. An authorized policymaker can exploit this vulnerability by issuing a large number of requests with distinct component values to the runtime-parameters lookup path. This action coerces attacker-supplied strings into new atoms, eventually exhausting the Erlang atom...

Malicious Package

Overview bnpl-blocks-atom-bnpl-search-input is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

PT-2026-97814

Name of the Vulnerable Software and Affected Versions libfyaml version 0.9.6 Description A stack exhaustion issue exists in the fy atom iter format function. When the software processes a specially crafted YAML document containing a very large literal or folded block scalar, the function repeated...

Linux Distros Unpatched Vulnerability : CVE-2026-67228

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an ato...

CVE-2026-67228

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters lookup path coerces the URL :component segment to an atom with rabbitdatacoercion:toatom/1 in lookupcomponent/1 deps/rabbit/src/rabbitruntimeparameters.erl, creating a new atom for any previous...

CVE-2026-67229

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addvhost/2 calls rabbitdatacoercion:atomizekeys/1 the unsafe variant using binarytoatom on the vhost metadata map. The 20 MB management body limit fits 1M+ short keys. Admin-only. An...