EUVD-2026-80808Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the non-default requirement that the app expose Qos to untrusted config (the 4.0 AT:P); availability-only client memory exhaustion, so C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 or 4294967295 instead of being rejected. An application that permits untrusted configuration of these Qos values can unintentionally request extremely large prefetch limits, allowing a broker to deliver enough queued messages to exhaust client memory and disrupt processing. This issue is fixed in version 1.13.0.
AnalysisAI
Memory exhaustion in the RabbitMQ amqp091-go Go AMQP 0.9.1 client library prior to 1.13.0 lets unauthenticated remote attackers who can influence an application's Qos settings make the client request an absurdly large prefetch limit and then buffer enough broker-delivered messages to exhaust host memory. Channel.Qos performs no bounds validation, so a negative prefetchCount or prefetchSize is cast straight into the uint16/uint32 fields of the basic.qos method and wraps to 65535 or 4294967295 instead of being rejected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an application built on amqp091-go prior to 1.13.0 that permits untrusted or externally-controlled configuration of the Channel.Qos prefetchCount/prefetchSize integers and forwards a negative value into that call; the library's missing validateQos then wraps it to an extremely large unsigned prefetch. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 score of 8.2 (High) is availability-only (VC:N/VI:N/VA:H, SA:L) and materially gated by AT:P - an explicit attack requirement that the embedding application must permit untrusted control of the Qos prefetchCount/prefetchSize values. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 1.13.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, generate a software bill of materials across all Go services to locate every instance of github.com/rabbitmq/amqp091-go and trace whether Channel.Qos prefetchCount or prefetchSize values can be influenced by untrusted input (tenant-supplied configuration, plugin parameters, admin APIs, or environment variables); where such a path exists, immediately clamp prefetch values to non-negative bounded integers at the call site and treat this as an emergency change. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed UR
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query p
Same weakness CWE-195 – Signed to Unsigned Conversion Error
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today