RabbitMQ client crashes from oversized messages

Published September 3, 2026 CVE-2026-79921

A malicious or hacked RabbitMQ server can trick apps using the amqp091-go library into accepting oversized messages. That can eat up all the memory on the app and crash it.

Severity
HighCVSS 4.0 · 8.9
Fix
Fixed in 1.13.0Fix recorded on Sep 3, 2026
Affected versions
before 1.13.0
Weakness
CWE-770Allocation of Resources Without Limits
Exploit likelihood
0.32% in 30 daysEPSS, higher than 24% of known flaws
Affects
amqp091-go+1 more

How it works

When an app connects, it and the broker agree on a maximum message chunk size, but the amqp091-go library never checks that a broker actually honors that limit, so a rogue broker can declare a chunk far bigger than agreed and the library will allocate memory for it anyway.

What to do

Check your Go module's dependency list for github.com/rabbitmq/amqp091-go and see which version it resolves; any versions older than 1.13.0 is affected. Run go list -m all in the project and look for the amqp091-go line, or inspect go.mod directly.

Update to amqp091-go version 1.13.0 or later, which enforces the negotiated frame size limit. There is no other workaround, so the update is the only fix, and this matters most if the RabbitMQ broker you connect to is untrusted or could be compromised.

Technical details

During the AMQP 0-9-1 handshake, client and broker negotiate a frame_max value, for example 4096 bytes. Before amqp091-go 1.13.0, the client did not enforce that limit on incoming content body frames: a broker could send a basic.deliver sequence with a body frame header declaring a size larger than frame_max, and the client would allocate memory for and read that oversized payload instead of closing the connection with a frame-error as the spec requires. This lets a compromised or malicious broker drive uncontrolled memory allocation on the client, leading to an out-of-memory crash (CWE-770, CVSS 8.9). No code execution or data exposure is described; the fix in 1.13.0 adds enforcement of the negotiated frame size.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions Present Attack depends on particular deployment or execution conditions
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes None No data tampering
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption High Severe or persistent loss of service in another system
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H Open in FIRST.org calculator

References

View Original Source