# CVE-2026-79921: RabbitMQ amqp091-go memory exhaustion in frame parsing

Source: https://junglewise.ai/threats/cve-2026-79921-rabbitmq-amqp091-go-memory-exhaustion-in-frame-parsing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-79921 · Severity: high · CVSS 4 · Published 2026-08-26

The amqp091-go library is a Go client for connecting to RabbitMQ message brokers using the AMQP protocol. A compromised or malicious broker can bypass negotiated frame size limits and force clients to allocate excessive memory for oversized message frames, causing application crashes or denial of service. This undermines a core safety feature of the AMQP protocol that clients and brokers establish at connection time.

Technologies: [github.com/rabbitmq/amqp091-go (Go)](https://junglewise.ai/threats/technologies/github-com-rabbitmq-amqp091-go), [RabbitMQ Amqp091-Go](https://junglewise.ai/threats/technologies/amqp091-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [RabbitMQ](https://junglewise.ai/threats/vendors/rabbitmq).

## Quick answers

**Is CVE-2026-79921 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79921 being exploited in the wild.

**How severe is CVE-2026-79921?** High severity, with a CVSS score of 4, published 26 August 2026.

**Which products and versions are affected?** github.com/rabbitmq/amqp091-go (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0; RabbitMQ Amqp091-Go < 1.13.0.

**Is there a fix for CVE-2026-79921?** Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-79921 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-79921?** Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later

  ```sh
  go get github.com/rabbitmq/amqp091-go@v1.13.0
  ```


## Technical details

The vulnerability is a resource exhaustion issue (CWE-770) stemming from improper validation of AMQP frame sizes. During the AMQP 0-9-1 handshake, clients and brokers negotiate a frame_max parameter (e.g., 4096 bytes) to limit frame sizes. However, amqp091-go fails to enforce this limit on incoming content body frames. After negotiation, a malicious broker can send a basic.deliver message with a declared payload size exceeding frame_max. Instead of closing the connection with a frame-error as mandated by the AMQP 0-9-1 specification, the client accepts the oversized declaration, allocates memory accordingly, reads the entire payload, and delivers the message. This allows an attacker to trigger large memory allocations and potential out-of-memory crashes. Attack vector is network-based (the attacker must be positioned as or control the broker), and requires no authentication or user interaction. The vulnerability is fixed in version 1.13.0 and later.

## Affected products

- RabbitMQ amqp091-go < 1.13.0

## Identifiers

- CVE-2026-79921
- GHSA-6c5v-hqjr-5xxp
- GO-2026-6372

## Timeline

- 2026-07-22: disclosed: Vulnerability published on GitHub Advisory Database
- 2026-08-26: advisory: Published to National Vulnerability Database
- 2026-09-03: patched: Version 1.13.0 released with fix

## References

- [https://api.github.com/users/suchitd](https://api.github.com/users/suchitd)
- [https://github.com/suchitd](https://github.com/suchitd)
- [https://api.github.com/users/suchitd/gists%7B/gist_id%7D](https://api.github.com/users/suchitd/gists%7B/gist_id%7D)
- [https://api.github.com/users/suchitd/repos](https://api.github.com/users/suchitd/repos)
- [https://avatars.githubusercontent.com/u/27207380?v=4](https://avatars.githubusercontent.com/u/27207380?v=4)
- [https://api.github.com/users/suchitd/events%7B/privacy%7D](https://api.github.com/users/suchitd/events%7B/privacy%7D)

## Related threats

- [amqp091-go pre-negotiation frame limit bypass in connection reader](https://junglewise.ai/threats/cve-2026-107386-amqp091-go-pre-negotiation-frame-limit-is-not-enforced-to-4kb)
- [RabbitMQ amqp091-go denial of service via malicious field length](https://junglewise.ai/threats/cve-2026-77412-rabbitmq-amqp091-go-denial-of-service-via-malicious-field-length)
- [RabbitMQ amqp091-go protocol desynchronization via integer overflow](https://junglewise.ai/threats/cve-2026-77411-rabbitmq-amqp091-go-protocol-desynchronization-via-integer)
- [RabbitMQ amqp091-go resource exhaustion via unbounded buffer allocation](https://junglewise.ai/threats/cve-2026-77410-rabbitmq-amqp091-go-resource-exhaustion-via-unbounded-buffer)
- [RabbitMQ amqp091-go synchronous notification blocking](https://junglewise.ai/threats/cve-2026-77409-rabbitmq-amqp091-go-synchronous-notification-blocking)