Executive brief
The RabbitMQ Go AMQP client library contains a flaw that allows a malicious or compromised message broker to crash client applications. When the client receives a specially crafted message frame with an invalid field length, it triggers an unrecoverable crash of the entire process. This creates a denial-of-service condition where legitimate applications using this library lose connectivity and functionality.
Technical details
The vulnerability exists in the readField function of the amqp091-go library, which parses AMQP frame data. When processing byte-array fields (type 'x'), the code reads a 32-bit signed integer to determine payload length and passes it directly to Go's make() function without validation. If a server sends a length value of 0xFFFFFFFF, it is interpreted as -1, causing make() to panic with "len out of range" since slice sizes must be non-negative. The panic occurs in the network I/O reader goroutine without recovery handling, terminating the entire host process. An attacker controlling or compromising the AMQP broker can inject malicious frames during connection establishment or message delivery to trigger this crash reliably.
Affected products
- RabbitMQ amqp091-go <UNKNOWN>
Timeline
- 2026-09-17: disclosed