Executive brief
The RabbitMQ Go AMQP client library does not validate the size of message bodies before allocating memory for them. A malicious or compromised AMQP broker can send a message with an extremely large declared size, causing the client application to attempt allocation of exabyte-scale memory buffers. This immediately exhausts system memory and triggers termination of the client process, resulting in service disruption and loss of in-flight work.
Technical details
The vulnerability exists in the `recvContent` function within the amqp091-go library's channel implementation. When processing a message content header frame, the code pre-allocates a slice buffer based on the `ch.header.Size` field (a 64-bit unsigned integer) without validation against the negotiated frame size limit (`FrameMax`). An attacker controlling or compromising an AMQP broker can craft a `basic.deliver` frame with an inflated body-size value (e.g., 2^62 bytes), causing the Go runtime to attempt allocation of impossible amounts of memory. No authentication or special privileges are required; the crash occurs during normal message consumption. The fix requires capping the pre-allocated buffer size to a reasonable maximum, typically the negotiated `FrameMax` value.
Affected products
- RabbitMQ amqp091-go
Timeline
- 2026-09-17: disclosed