Executive brief
The amqp091-go library is a Go client for connecting to RabbitMQ message brokers using the AMQP protocol. A compromised or malicious broker can bypass negotiated frame size limits and force clients to allocate excessive memory for oversized message frames, causing application crashes or denial of service. This undermines a core safety feature of the AMQP protocol that clients and brokers establish at connection time.
Technical details
The vulnerability is a resource exhaustion issue (CWE-770) stemming from improper validation of AMQP frame sizes. During the AMQP 0-9-1 handshake, clients and brokers negotiate a frame_max parameter (e.g., 4096 bytes) to limit frame sizes. However, amqp091-go fails to enforce this limit on incoming content body frames. After negotiation, a malicious broker can send a basic.deliver message with a declared payload size exceeding frame_max. Instead of closing the connection with a frame-error as mandated by the AMQP 0-9-1 specification, the client accepts the oversized declaration, allocates memory accordingly, reads the entire payload, and delivers the message. This allows an attacker to trigger large memory allocations and potential out-of-memory crashes. Attack vector is network-based (the attacker must be positioned as or control the broker), and requires no authentication or user interaction. The vulnerability is fixed in version 1.13.0 and later.
Affected products
- RabbitMQ amqp091-go < 1.13.0
Timeline
- 2026-07-22: disclosed: Vulnerability published on GitHub Advisory Database
- 2026-08-26: advisory: Published to National Vulnerability Database
- 2026-09-03: patched: Version 1.13.0 released with fix