Is CVE-2026-107386 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107386 being exploited in the wild.

How severe is CVE-2026-107386?

Medium severity, with a CVSS score of 4, published 8 October 2026.

Which products and versions are affected?

github.com/rabbitmq/amqp091-go (Go) < 1.14.0, SEMVER:introduced=0,fixed=1.14.0; RabbitMQ Amqp091-Go up to v1.13.0.

How is CVE-2026-107386 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107386?

Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107386: amqp091-go pre-negotiation frame limit bypass in connection reader

Q: Is there a fix for CVE-2026-107386?

Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.14.0 or later. Until then: Apply the fix in a patched version when released. Until patched, restrict network access to trusted AMQP brokers and monitor client process memory usage during connection establishment. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107386 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-107386?

Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107386 · Severity: medium · CVSS 4 · Published 2026-10-08

amqp091-go is a Go client library for AMQP messaging servers like RabbitMQ. A malicious or compromised AMQP broker can trigger excessive memory allocation in the client during connection setup, before the frame size negotiation completes, potentially causing the process to run out of memory and crash. An attacker needs only a network position as the AMQP peer; no credentials or user interaction is required.

Technologies: github.com/rabbitmq/amqp091-go (Go), RabbitMQ Amqp091-Go. Vendors: Go, RabbitMQ.

Quick answers

Is CVE-2026-107386 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107386 being exploited in the wild.
How severe is CVE-2026-107386?: Medium severity, with a CVSS score of 4, published 8 October 2026.
Which products and versions are affected?: github.com/rabbitmq/amqp091-go (Go) < 1.14.0, SEMVER:introduced=0,fixed=1.14.0; RabbitMQ Amqp091-Go up to v1.13.0.
Is there a fix for CVE-2026-107386?: Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.14.0 or later. Until then: Apply the fix in a patched version when released. Until patched, restrict network access to trusted AMQP brokers and monitor client process memory usage during connection establishment. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107386 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107386?: Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/rabbitmq/amqp091-go (Go): upgrade to 1.14.0 or later
```
go get github.com/rabbitmq/amqp091-go@v1.14.0
```

Apply the fix in a patched version when released. Until patched, restrict network access to trusted AMQP brokers and monitor client process memory usage during connection establishment.

Technical details

The vulnerability is a state-boundary bypass in frame-size validation: the reader goroutine starts before connection negotiation, and while maxFrameSize remains zero (the pre-negotiation state), it treats zero as meaning "negotiated unlimited" and skips size checks. An attacker-controlled 32-bit frame length in a 7-byte body-frame header triggers a make([]byte, size) call before payload verification, allowing allocation of up to ~4 GiB on 64-bit systems without transmitting the payload. The fix in v1.13.0 only applies when maxFrameSize is nonzero, leaving the pre-negotiation window open.

Affected products

RabbitMQ amqp091-go up to v1.13.0

Identifiers

CVE-2026-107386
GHSA-w6r9-248c-frg8
GO-2026-6700

Timeline

2026-10-08: disclosed
2026-10-08: advisory: GHSA-w6r9-248c-frg8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.