RabbitMQ EUVD-2026-85650

Requires an authenticated user holding the RabbitMQ administrator tag who imports a definitions file (via the management plugin API/UI). The specific trigger is a vhosts entry whose metadata map contains ~1M unique keys - the 20MB management body limit accommodates over a million short keys, and add_vhost/2 uses the unsafe rabbit_data_coercion:atomize_keys/1 variant (binary_to_atom) with no atom whitelist or cap. Limiting factors: exploitation is gated behind administrator privileges (PR:H), affects only the single node processing the import, causes availability loss only (no data disclosure or tampering), and any RabbitMQ instance at or above 3.13.15/4.0.20/4.1.11/4.2.6/4.3.0 is patched.

This is a genuine but tightly-scoped availability issue, not a broadly exploitable one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VA:H, 6.9 MEDIUM) is dominated by the PR:H requirement: exploitation demands an authenticated user with the administrator tag who imports a crafted definitions file. Impact is availability-only (VC:N/VI:N/VA:H, VA:H) - a single node crash from atom-table exhaustion, with no confidentiality or integrity loss. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no signal of active or automatable exploitation. The realistic risk is therefore low-to-moderate: an administrator can already disrupt a broker they control through many legitimate means, so the practical threat is an admin account compromise or a malicious/careless insider using a poisoned definitions export rather than a remote outsider. High CVSS-adjacent labels ('Denial Of Service') should not inflate prioritization here - the PR:H gate and admin-only precondition make this a patch-on-normal-cadence item, not an emergency, except for multi-admin or hostile-insider threat models.

An attacker who has obtained RabbitMQ administrator-tag credentials (or a malicious insider) uploads a crafted definitions file through the management API/UI in which a single vhosts entry contains roughly one million unique metadata keys. On import, add_vhost/2 coerces every key to an Erlang atom via binary_to_atom, exhausting the atom table and crashing the broker node in one request. No public exploit code is identified at time of analysis, but the mechanism is described precisely in the vendor advisory (GHSA-ggrw-qm45-hwpv).