# CVE-2026-77403: RabbitMQ amqp091-go denial of service in frame size negotiation

Source: https://junglewise.ai/threats/cve-2026-77403-rabbitmq-amqp091-go-denial-of-service-in-frame-size-negotiation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77403 · Severity: high · CVSS 4 · Published 2026-09-16

RabbitMQ's AMQP client library for Go fails to validate the minimum frame size negotiated with a broker during connection setup. An attacker controlling or intercepting a broker connection can force the client to accept a frame size as small as 1 byte, causing all message transmissions to be fragmented into thousands of tiny frames. This results in severe CPU exhaustion and application freezes, rendering the affected service unusable.

Technologies: [github.com/rabbitmq/amqp091-go (Go)](https://junglewise.ai/threats/technologies/github-com-rabbitmq-amqp091-go), [RabbitMQ Amqp091-Go](https://junglewise.ai/threats/technologies/amqp091-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [RabbitMQ](https://junglewise.ai/threats/vendors/rabbitmq).

## Quick answers

**Is CVE-2026-77403 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77403 being exploited in the wild.

**How severe is CVE-2026-77403?** High severity, with a CVSS score of 4, published 16 September 2026.

**Which products and versions are affected?** github.com/rabbitmq/amqp091-go (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0.

**Is there a fix for CVE-2026-77403?** Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77403 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-77403?** Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later

  ```sh
  go get github.com/rabbitmq/amqp091-go@v1.13.0
  ```


## Technical details

The vulnerability exists in the connection negotiation logic where the client accepts the server's advertised FrameMax parameter without enforcing the AMQP specification's minimum of 4096 bytes. The code directly assigns the server-supplied value to the connection config without validation: if the server advertises FrameMax=1, the client accepts it. Subsequently, any message transmission is forced to split the payload into single-byte frames, triggering massive CPU overhead from frame serialization, memory allocation, and context switching. The attack is triggered when a client connects to a malicious or man-in-the-middle-controlled AMQP broker. No patch information is currently documented in the advisory.

## Affected products

- RabbitMQ amqp091-go

## Identifiers

- CVE-2026-77403
- GHSA-xwwf-m8fg-p9q2
- GO-2026-6503

## Timeline

- 2026-09-17: disclosed: Advisory GHSA-xwwf-m8fg-p9q2 published
- 2026: other: CVE-2026-77403 assigned

## Related threats

- [amqp091-go pre-negotiation frame limit bypass in connection reader](https://junglewise.ai/threats/cve-2026-107386-amqp091-go-pre-negotiation-frame-limit-is-not-enforced-to-4kb)
- [RabbitMQ amqp091-go denial of service via malicious field length](https://junglewise.ai/threats/cve-2026-77412-rabbitmq-amqp091-go-denial-of-service-via-malicious-field-length)
- [RabbitMQ amqp091-go protocol desynchronization via integer overflow](https://junglewise.ai/threats/cve-2026-77411-rabbitmq-amqp091-go-protocol-desynchronization-via-integer)
- [RabbitMQ amqp091-go resource exhaustion via unbounded buffer allocation](https://junglewise.ai/threats/cve-2026-77410-rabbitmq-amqp091-go-resource-exhaustion-via-unbounded-buffer)
- [RabbitMQ amqp091-go synchronous notification blocking](https://junglewise.ai/threats/cve-2026-77409-rabbitmq-amqp091-go-synchronous-notification-blocking)