Executive brief
RabbitMQ's AMQP client library for Go fails to validate the minimum frame size negotiated with a broker during connection setup. An attacker controlling or intercepting a broker connection can force the client to accept a frame size as small as 1 byte, causing all message transmissions to be fragmented into thousands of tiny frames. This results in severe CPU exhaustion and application freezes, rendering the affected service unusable.
Technical details
The vulnerability exists in the connection negotiation logic where the client accepts the server's advertised FrameMax parameter without enforcing the AMQP specification's minimum of 4096 bytes. The code directly assigns the server-supplied value to the connection config without validation: if the server advertises FrameMax=1, the client accepts it. Subsequently, any message transmission is forced to split the payload into single-byte frames, triggering massive CPU overhead from frame serialization, memory allocation, and context switching. The attack is triggered when a client connects to a malicious or man-in-the-middle-controlled AMQP broker. No patch information is currently documented in the advisory.
Affected products
- RabbitMQ amqp091-go
Timeline
- 2026-09-17: disclosed: Advisory GHSA-xwwf-m8fg-p9q2 published
- 2026: other: CVE-2026-77403 assigned