BIT-RABBITMQ-2026-67229 RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, addvhost/2 calls rabbitdatacoercion:atomizekeys/1 the unsafe variant using binarytoatom on the vhost metadata map. The 20 MB management body limit fits 1M+ short keys. Admin-only. An...

CVE-2026-67229

A flaw was found in RabbitMQ, a messaging and streaming broker. An administrator with appropriate privileges can trigger a Denial of Service DoS by importing a specially crafted definitions file. This file, containing a large number of unique metadata keys, causes the system to exhaust its atom...

PT-2026-97582

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An administrator with the required tags can crash the node in ...

RabbitMQ: RabbitMQ: Denial of Service via admin-only atom exhaustion from crafted vhost metadata

A flaw was found in RabbitMQ, a messaging and streaming broker. An administrator with appropriate privileges can trigger a Denial of Service DoS by importing a specially crafted definitions file. This file, containing a large number of unique metadata keys, causes the system to exhaust its atom...

CVE-2026-31899

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input...

CVE-2026-31899

CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Kozea/CairoSVG has exponential denial of service via recursive element amplification in cairosvg/defs.py. This causes CPU exhaustion from a small input...

shadow-utils security update

An update is available for shadow-utils. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The shadow-utils packages include programs for converting UNIX password...