EUVD-2026-80819Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-facing parsing but requires a malicious/compromised broker (mapped to AC:H); no auth on the client side (PR:N); crash-only so C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compromised broker can encode a value such as 0xFFFFFFFF, which becomes -1 and causes a len out of range runtime panic. The panic escapes the network reader goroutine and terminates the client process, including during connection.start server properties or message header table parsing. This issue is fixed in version 1.13.0.
AnalysisAI
Denial of service in the official RabbitMQ Go client library amqp091-go (versions prior to 1.13.0): a malicious, compromised, or impersonated AMQP 0.9.1 broker can crash any application that connects to it. By encoding a byte-array field length as 0xFFFFFFFF (decoded into a signed int32 as -1) inside the connection.start server-properties table or a message header field table, the broker drives readField() to call make() with a negative size, producing a 'len out of range' runtime panic that escapes the reader goroutine and terminates the client process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the victim application to establish an AMQP 0.9.1 connection to a broker that the attacker controls, has compromised, or can impersonate via MITM - the malicious length value is delivered from the broker side during connection.start server-properties parsing or when parsing a message header field table. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is an availability-only denial-of-service in the official Go RabbitMQ client (amqp091-go), driven by a CWE-681 signed/unsigned conversion bug: a byte-array length field is read into a signed int32 and passed to make(), so a broker-supplied 0xFFFFFFFF becomes -1 and triggers a 'len out of range' panic that kills the client process. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the amqp091-go module dependency to 1.13.0 or later (Vendor-released patch: 1.13.0), which is available from the upstream repository at https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0 and documented in advisory GHSA-4v58-74mf-rjx3; the fix is a small guard in readField (PR #344, commit 669b42bf7b1db76bc6d4973e3634247f680accbf) so bumping the module version is sufficient, with no API changes required in calling code. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications and services that depend on the amqp091-go library and determine which connect to brokers outside your direct trust boundary, such as third-party, partner, or internet-reachable AMQP endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed UR
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query p
Same weakness CWE-681 – Incorrect Conversion between Numeric Types
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today