CVE-2026-79921: amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
amqp091-goto a version that resolves this vulnerability.Fixed in 1.13.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using amqp091-go before version 1.13.0 are exposed when they connect to a compromised or malicious AMQP broker. The broker can send content body frames larger than the negotiated frame_max limit.
What does an attacker need to exploit it?
An attacker needs control of, or the ability to compromise, the AMQP broker used by the client. Exploitation occurs through oversized broker-sent content body frames and can cause unexpected memory consumption or application-layer denial of service.
What should teams do if they cannot patch immediately?
No known workarounds are available. Upgrade amqp091-go to version 1.13.0, which contains the fix.