CVE-2026-77403: RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP broker can therefore advertise an extremely small FrameMax, causing later client publications to be fragmented into excessive numbers of frames and write operations. This can consume CPU and stall the client or its host. This issue is fixed in version 1.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQ amqp091-goto a version that resolves this vulnerability.Fixed in 1.13.0
Event History
Frequently Asked Questions
Which clients are exposed to this denial-of-service condition?
Applications using RabbitMQ amqp091-go versions earlier than 1.13.0 are affected when they connect to a malicious or compromised AMQP broker that advertises an undersized FrameMax value.
What must an attacker control to trigger the issue?
The attacker needs to operate or compromise an AMQP broker that the client connects to. During connection tuning, the broker must advertise a FrameMax value below the AMQP minimum of 4096 bytes.
What is the practical effect on an affected client?
Later publications can be split into an excessive number of frames and write operations. This can consume CPU and stall the client process or its host.
What remediation is available?
Upgrade RabbitMQ amqp091-go to version 1.13.0, which enforces the protocol minimum during frame-size negotiation.