The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, The runtime-parameters     lookup path coerces the URL :component segment to an atom with rabbit_data_coercion:to_atom/1 in     lookup_component/1 (deps/rabbit/src/rabbit_runtime_parameters.erl), creating a new atom for any previously     unseen value. A safe helper, rabbit_registry:binary_to_type/1, which uses binary_to_existing_atom with a     catch, already exists but is not used at this call site. lookup_component/1 calls     rabbit_data_coercion:to_atom(Component) on the :component segment of the request URL, converting an     attacker-supplied string into a new atom. Because the Erlang atom table is bounded and atoms are never     garbage collected, an authorized policymaker issuing roughly one million requests with distinct component     values can exhaust the atom table and crash the node, resulting in a denial of service. Preconditions     include Exploitation requires policymaker privileges and roughly one million requests.. This issue is     fixed in versions 4.2.7 and 4.3.1. (CVE-2026-67228)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-67228

medium Nessus Plugin ID 349687

Version 1.5