RabbitMQ EUVD-2026-85653

Requires an authenticated account with the RabbitMQ 'policymaker' tag (the role permitted to manage runtime parameters/policies) and the ability to reach the management/runtime-parameters HTTP API. Exploitation further requires issuing roughly one million requests, each with a distinct, previously-unseen :component URL segment, to accumulate enough uniquely-interned atoms to exhaust the bounded Erlang atom table. Limiting factors: the high privilege level (policymaker, not a general low-privilege user), the large request volume needed (~1M), and availability-only impact (node crash) with no data exposure. Only versions prior to 4.2.7 and 4.3.1 are affected.

All signals converge on a moderate, low-urgency issue. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VA:H, score 6.9) captures a network-reachable but high-privilege availability-only flaw: the only impact is a node crash (VA:H), with no confidentiality or integrity effect. Critically, exploitation requires 'policymaker' privileges (PR:H) - a trusted administrative role that can already set runtime parameters and policies - plus roughly one million distinct HTTP requests to fill the bounded Erlang atom table. My independent CVSS 3.1 assessment is ~4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, Medium), consistent with the vendor's 4.0 rating. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so this is 'no public exploit identified.' The combination of high required privilege, a brute-force volume prerequisite (~1M requests), and availability-only impact makes this a low real-world priority rather than a high-urgency threat - a privileged insider or a compromised policymaker credential is needed, and the same actor could disrupt the broker through legitimate means. This is a genuine but low-severity hardening bug, not a widespread exploitation risk.

An authenticated user holding the policymaker tag (or an attacker who has stolen such credentials) scripts roughly one million HTTP requests to the runtime-parameters lookup endpoint, each carrying a distinct, previously-unseen :component URL segment. Because lookup_component/1 coerces that segment via rabbit_data_coercion:to_atom/1, each unique value interns a new atom that is never garbage-collected, eventually exhausting the bounded Erlang atom table and crashing the node (denial of service). No public exploit code has been identified; exploitation is straightforward scripting but gated by high privilege and request volume.