CVE-2026-77410: RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header.Size value supplied by an AMQP content header without capping the allocation to the negotiated Connection.Config.FrameSize value. A malicious or compromised broker can send an extreme declared body size and cause the Go runtime to attempt a correspondingly large allocation before body data is received. The allocation can exhaust memory and terminate the client process. This issue is fixed in version 1.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQ amqp091-goto a version that resolves this vulnerability.Fixed in 1.13.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using RabbitMQ amqp091-go versions before 1.13.0 are exposed when they receive AMQP content from a malicious or compromised broker.
What does an attacker need to do to trigger the condition?
The attacker needs to control, or be able to make a broker send, an AMQP content header with an extreme declared body size. The client may attempt to allocate memory for that declared size before receiving the body data.
Does exploitation require sending a large message body?
No. The allocation is based on the uint64 body-size value declared in the content header, before body data is received.
What is the remediation?
Upgrade RabbitMQ amqp091-go to version 1.13.0, which fixes the unbounded body-buffer allocation.