A vulnerability in RabbitMQ Server allows an authenticated user with policymaker privileges to trigger a node crash through atom table exhaustion, resulting in a denial of service.

The vulnerability exists in the runtime-parameters lookup path where the application coerces URL component segments into new Erlang atoms. Because these atoms are never garbage collected and the table size is finite, an attacker with policymaker-level authentication can intentionally exhaust the table by sending a large volume of requests with unique values.

The exploitation of this flaw leads to a complete denial of service for the affected RabbitMQ node, which can disrupt critical messaging and streaming services for enterprise applications. While the CVSS score of 6.9 reflects a medium severity, the potential for service instability and the requirement for authenticated access necessitates prompt attention to maintain operational uptime and system reliability.

Immediate Action: Upgrade to RabbitMQ Server version 4.2.7 or 4.3.1 to incorporate the fix that prevents uncontrolled atom creation.

Proactive Monitoring: Monitor system logs for a high volume of requests targeting runtime parameter endpoints and track resource utilization metrics for the Erlang VM, specifically monitoring for unexpected increases in memory consumption related to atom storage.

Compensating Controls: Restrict administrative and policymaker access to the RabbitMQ management interface to only trusted administrative accounts, and utilize network access controls to limit access to the broker management ports.

Public Exploit Available: No

Organizations utilizing RabbitMQ Server should prioritize patching to the latest versions, 4.2.7 or 4.3.1, to eliminate this resource exhaustion vector. Given that the vulnerability requires elevated privileges, security teams should also audit existing policymaker accounts to ensure that access is limited to the principle of least privilege, thereby reducing the risk of internal or compromised-account exploitation.