EUVD-2026-80807Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because the attacker must control or compromise the broker the client connects to (non-default trust condition); network vector, no client-side privileges/UI, availability-only impact so C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP broker can therefore advertise an extremely small FrameMax, causing later client publications to be fragmented into excessive numbers of frames and write operations. This can consume CPU and stall the client or its host. This issue is fixed in version 1.13.0.
AnalysisAI
Denial of service in the RabbitMQ amqp091-go Go client for AMQP 0.9.1 (versions prior to 1.13.0) allows a malicious or compromised broker to advertise a FrameMax below the protocol's 4096-byte frameMinSize during connection negotiation, causing the client to fragment subsequent publications into an excessive number of frames and write operations, consuming CPU and stalling the client process or its host. The assessed vector carries PR:N, so no authentication is required on the client side, but exploitation is bounded by a trust-boundary prerequisite: the victim Go application must connect to a broker that the attacker controls or has compromised, and TLS with proper broker authentication prevents an unrelated network attacker from impersonating the broker. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim Go application (using amqp091-go < 1.13.0) to establish an AMQP connection to a broker that the attacker controls or has compromised - the malicious broker must advertise a FrameMax below the 4096-byte AMQP frameMinSize during the openTune connection-negotiation handshake. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is an availability-only denial-of-service in the official Go RabbitMQ AMQP 0.9.1 client (amqp091-go) below 1.13.0. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade rabbitmq/amqp091-go to v1.13.0, which introduces the negotiateFrameSize() floor enforcing the 4096-byte AMQP frameMinSize (release notes at https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0, advisory at https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-xwwf-m8fg-p9q2). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Go applications using the RabbitMQ amqp091-go client for AMQP 0.9.1, especially versions prior to 1.13.0, and verify that every broker they connect to is trusted; enforce TLS with proper broker authentication to prevent impersonation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed UR
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query p
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today