Is CVE-2026-79921 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79921 being exploited in the wild.

How severe is CVE-2026-79921?

High severity, with a CVSS score of 4, published 26 August 2026.

Which products and versions are affected?

github.com/rabbitmq/amqp091-go (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0; RabbitMQ Amqp091-Go < 1.13.0.

Is there a fix for CVE-2026-79921?

Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79921 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-79921?

Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79921: RabbitMQ amqp091-go memory exhaustion in frame parsing

Q: Is there a fix for CVE-2026-79921?

Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-79921 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-79921?

Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79921 · Severity: high · CVSS 4 · Published 2026-08-26

The amqp091-go library is a Go client for connecting to RabbitMQ message brokers using the AMQP protocol. A compromised or malicious broker can bypass negotiated frame size limits and force clients to allocate excessive memory for oversized message frames, causing application crashes or denial of service. This undermines a core safety feature of the AMQP protocol that clients and brokers establish at connection time.

Technologies: github.com/rabbitmq/amqp091-go (Go), RabbitMQ Amqp091-Go. Vendors: Go, RabbitMQ.

Quick answers

Is CVE-2026-79921 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79921 being exploited in the wild.
How severe is CVE-2026-79921?: High severity, with a CVSS score of 4, published 26 August 2026.
Which products and versions are affected?: github.com/rabbitmq/amqp091-go (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0; RabbitMQ Amqp091-Go < 1.13.0.
Is there a fix for CVE-2026-79921?: Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79921 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-79921?: Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later
```
go get github.com/rabbitmq/amqp091-go@v1.13.0
```

Technical details

The vulnerability is a resource exhaustion issue (CWE-770) stemming from improper validation of AMQP frame sizes. During the AMQP 0-9-1 handshake, clients and brokers negotiate a frame_max parameter (e.g., 4096 bytes) to limit frame sizes. However, amqp091-go fails to enforce this limit on incoming content body frames. After negotiation, a malicious broker can send a basic.deliver message with a declared payload size exceeding frame_max. Instead of closing the connection with a frame-error as mandated by the AMQP 0-9-1 specification, the client accepts the oversized declaration, allocates memory accordingly, reads the entire payload, and delivers the message. This allows an attacker to trigger large memory allocations and potential out-of-memory crashes. Attack vector is network-based (the attacker must be positioned as or control the broker), and requires no authentication or user interaction. The vulnerability is fixed in version 1.13.0 and later.

Affected products

RabbitMQ amqp091-go < 1.13.0

Identifiers

CVE-2026-79921
GHSA-6c5v-hqjr-5xxp
GO-2026-6372

Timeline

2026-07-22: disclosed: Vulnerability published on GitHub Advisory Database
2026-08-26: advisory: Published to National Vulnerability Database
2026-09-03: patched: Version 1.13.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.