amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
Priority MEDIUM 45CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 7 fixed, 3 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0055 46th percentileScored 2026-11-07
Fix Partial amqp091-go (rabbitmq): 1.13.0github.com/rabbitmq/amqp091-go (Go): 1.13.0Red Hat: 9 advisoriesRed Hat: 7 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rabbitmq | amqp091-go | before 1.13.0 | 1.13.0 | Patch available | CNA |
| — | github.com/rabbitmq/amqp091-go (Go) | before 1.13.0 | 1.13.0 | Patch available | GHSA-6c5v-hqjr-5xxp |
- amqp091-go Vendorrabbitmq Affected before 1.13.0 Fixed in 1.13.0 Patch available CNA
- github.com/rabbitmq/amqp091-go (Go) Vendor— Affected before 1.13.0 Fixed in 1.13.0 Patch available GHSA-6c5v-hqjr-5xxp
Remediation
- Fix · CNA amqp091-go (rabbitmq) Fixed in 1.13.0
- Fix · GHSA-6c5v-hqjr-5xxp github.com/rabbitmq/amqp091-go (Go) Fixed in 1.13.0 Advisory →
Red Hat 9 advisories
- RHSA-2026:80217 Released 2026-10-09 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images opentelemetry-collector-contrib-0.162.0-0.2.hum1@aarch64, opentelemetry-collector-contrib-0.162.0-0.2.hum1@src, opentelemetry-collector-contrib-0.162.0-0.2.hum1@x86_64
- RHSA-2026:79546 Released 2026-10-08 · Red Hat rating ImportantRed Hat Quay 3.12.23
- Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:79366 Released 2026-10-08 · Red Hat rating ImportantRed Hat Quay 3.10.27
- Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
Show 6 more Red Hat advisories
- RHSA-2026:77656 Released 2026-10-07 · Red Hat rating ImportantRed Hat Quay 3.9.27
- Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:73038 Released 2026-09-29 · Red Hat rating ImportantMulticluster Global Hub 1.8.2 security update
- Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
- RHSA-2026:68515 Released 2026-09-17 · Red Hat rating ImportantMulticluster Global Hub 1.8.2 security update
- Multicluster Global Hub 1.8.2 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
- RHSA-2026:67842 Released 2026-09-16 · Red Hat rating ImportantMulticluster Global Hub 1.7.3 security update
- Multicluster Global Hub 1.7.4 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9, registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9 +2
- RHSA-2026:62866 Released 2026-09-02 · Red Hat rating ImportantCustom Metrics Autoscaler Operator for Red Hat OpenShift 2.19.0-3 This version is a rebuild of 2.19.0 using a newer base image, Go modules and Go compiler, and two bug fixes. See the release notes for more information.
- Custom Metric Autoscaler 2.19 registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9, registry.redhat.io/custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-interceptor-rhel9 +5
- RHSA-2026:60854 Released 2026-08-29 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images opentelemetry-collector-contrib-0.159.0-0.1.1.hum1@aarch64, opentelemetry-collector-contrib-0.159.0-0.1.1.hum1@src, opentelemetry-collector-contrib-0.159.0-0.1.1.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| Custom Metric Autoscaler 2.19 | Fixed | RHSA-2026:62866 |
| Multicluster Global Hub 1.7.4 | Fixed | RHSA-2026:67842 |
| Multicluster Global Hub 1.8.2 | Fixed | RHSA-2026:68515, RHSA-2026:73038 |
| Red Hat Hardened Images | Fixed | RHSA-2026:60854, RHSA-2026:80217 |
| Red Hat Quay 3.10 | Fixed | RHSA-2026:79366 |
| Red Hat Quay 3.12 | Fixed | RHSA-2026:79546 |
| Red Hat Quay 3.9 | Fixed | RHSA-2026:77656 |
Not affected: 7 products
- Cryostat 4
- Multicluster Global Hub 1.7.4
- Multicluster Global Hub 1.8.2
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Quay 3.10
- Red Hat Quay 3.12
- Red Hat Quay 3.9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-79921
- 2026-10-03 Alias added: GHSA-6c5v-hqjr-5xxp
- 2026-10-07 Fix available: RHSA-2026:77656 · Red Hat
- 2026-10-08 Fix available: Red Hat Quay 3.9 · Red Hat
- 2026-10-09 Fix available: RHSA-2026:79546 · Red Hat
- 2026-10-09 Fix available: RHSA-2026:79366 · Red Hat
- 2026-10-09 Fix available: Red Hat Quay 3.10, Red Hat Quay 3.12 · Red Hat
- 2026-10-10 Fix available: RHSA-2026:80217 · Red Hat
- 2026-10-10 Affected versions changed · Red Hat
- 2026-11-06 Fix available: Multicluster Global Hub 1.7.4 · Red Hat
References
Other 5
- https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp
- https://github.com/rabbitmq/amqp091-go/pull/353
- https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0
- https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0
- https://github.com/rabbitmq/amqp091-go
More rabbitmq vulnerabilities
- TI-2026-41154 Improper authentication in rabbitmq-server CVSS 3.1CRITICAL 10.0
- TI-2026-41149 RabbitMQ: UNC SSRF affecting the management UI on Windows CVSS 3.1CRITICAL 10.0
- TI-2026-41158 Resource allocation without limits in rabbitmq-server CVSS 3.1HIGH 7.5
- TI-2026-47695 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CVSS 4.0HIGH 8.2
- TI-2026-47694 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CVSS 4.0HIGH 8.2
- TI-2026-45167 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading CVSS 4.0HIGH 7.5
Sources
- CVE-2026-79921 · CVE Program
- CVE-2026-79921 · NVD
- FIRST EPSS
- GHSA-6c5v-hqjr-5xxp · GitHub Advisory Database · CC BY 4.0
- CVE-2026-79921 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences