EUVD-2026-80810Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires the client to be connected to a malicious/compromised broker (a trust precondition, mapping the 4.0 AT:P); impact is client-process crash only, so C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
6DescriptionCVE.org
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header.Size value supplied by an AMQP content header without capping the allocation to the negotiated Connection.Config.FrameSize value. A malicious or compromised broker can send an extreme declared body size and cause the Go runtime to attempt a correspondingly large allocation before body data is received. The allocation can exhaust memory and terminate the client process. This issue is fixed in version 1.13.0.
AnalysisAI
Memory-exhaustion denial of service in the official RabbitMQ Go AMQP 0.9.1 client library (amqp091-go) prior to 1.13.0 lets a malicious or compromised broker kill client processes: when a content header frame arrives, the client preallocates the message body buffer using the broker-declared 64-bit body size without capping that hint to the negotiated Connection.Config.FrameSize, so an extreme declared size drives a correspondingly huge Go heap allocation before any body bytes are received, exhausting memory and terminating the process. The exploitation model is broker-attacks-its-clients rather than exploitation by an arbitrary network attacker (CVSS 4.0 8.9 with AT:P, and the assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning the victim application must connect to a broker that is hostile, subverted, or on a path an attacker can tamper with; no client credentials or unusual configuration are needed, and a FrameSize of 0 ("unlimited") removes the cap entirely even after patching. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the vulnerable amqp091-go client (prior to 1.13.0) to establish an AMQP 0.9.1 connection to a broker that is malicious or has been compromised (or to a broker connection an attacker can actively tamper with); the attacker-controlled broker must send a content header frame with an extreme declared body Size. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a client-side denial-of-service in the official RabbitMQ Go AMQP 0.9.1 client library, not a server-side or arbitrary-code flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the dependency to the vendor-released patched version, amqp091-go 1.13.0 (or later), which caps the body preallocation at the negotiated Connection.Config.FrameSize; see the release at https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0, the advisory at https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-r9c8-gcjp-xfwh, and the fix in https://github.com/rabbitmq/amqp091-go/pull/346 (commit 91b65fa0096a99a580cf51a31b24028ff1c60382) - no patched version other than 1.13.0 should be assumed to contain the fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Go application and build pipeline that depends on amqp091-go and confirm which ones resolve to versions prior to 1.13.0; flag any connection configuration that sets FrameSize to 0 (unlimited), since that removes the memory cap entirely, and where the setting is tunable reset it to a bounded non-zero value. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed UR
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query p
Share
External POC / Exploit Code
Leaving vuln.today