Is CVE-2026-77403 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77403 being exploited in the wild.

How severe is CVE-2026-77403?

High severity, with a CVSS score of 4, published 16 September 2026.

Which products and versions are affected?

github.com/rabbitmq/amqp091-go (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0.

Is there a fix for CVE-2026-77403?

Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77403 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77403?

Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77403: RabbitMQ amqp091-go denial of service in frame size negotiation

Q: Is there a fix for CVE-2026-77403?

Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77403 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-77403?

Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77403 · Severity: high · CVSS 4 · Published 2026-09-16

RabbitMQ's AMQP client library for Go fails to validate the minimum frame size negotiated with a broker during connection setup. An attacker controlling or intercepting a broker connection can force the client to accept a frame size as small as 1 byte, causing all message transmissions to be fragmented into thousands of tiny frames. This results in severe CPU exhaustion and application freezes, rendering the affected service unusable.

Technologies: github.com/rabbitmq/amqp091-go (Go), RabbitMQ Amqp091-Go. Vendors: Go, RabbitMQ.

Quick answers

Is CVE-2026-77403 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77403 being exploited in the wild.
How severe is CVE-2026-77403?: High severity, with a CVSS score of 4, published 16 September 2026.
Which products and versions are affected?: github.com/rabbitmq/amqp091-go (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0.
Is there a fix for CVE-2026-77403?: Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77403 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77403?: Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later
```
go get github.com/rabbitmq/amqp091-go@v1.13.0
```

Technical details

The vulnerability exists in the connection negotiation logic where the client accepts the server's advertised FrameMax parameter without enforcing the AMQP specification's minimum of 4096 bytes. The code directly assigns the server-supplied value to the connection config without validation: if the server advertises FrameMax=1, the client accepts it. Subsequently, any message transmission is forced to split the payload into single-byte frames, triggering massive CPU overhead from frame serialization, memory allocation, and context switching. The attack is triggered when a client connects to a malicious or man-in-the-middle-controlled AMQP broker. No patch information is currently documented in the advisory.

Affected products

RabbitMQ amqp091-go

Identifiers

CVE-2026-77403
GHSA-xwwf-m8fg-p9q2
GO-2026-6503

Timeline

2026-09-17: disclosed: Advisory GHSA-xwwf-m8fg-p9q2 published
2026: other: CVE-2026-77403 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.