EUVD-2026-66715Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because exploitation requires client connection to a malicious or compromised broker; no confidentiality or integrity impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.
AnalysisAI
Unbounded memory allocation in amqp091-go (RabbitMQ's official Go AMQP 0.9.1 client) before v1.13.0 allows a malicious or compromised AMQP broker to force connected clients to allocate and process content body frames exceeding the negotiated frame_max limit, bypassing protocol framing constraints and causing application-layer denial of service. The root cause - confirmed via PR diff - is the client's blind acceptance of broker-advertised frame sizes during the TUNE handshake without enforcing the AMQP specification's minimum frame floor. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim Go application connects to an AMQP broker controlled by or compromised by the attacker - this is the specific prerequisite captured by AT:P in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.9 reflects a network-reachable attack vector (AV:N) with low complexity (AC:L), but the AT:P metric (attack requirements present) is the critical risk moderator: exploitation requires the victim client to connect to a broker that is either controlled by the attacker or has been compromised. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who operates or has compromised an AMQP broker sends a crafted TUNE response during the connection handshake, advertising a frame_max value designed to cause the client to accept and allocate memory for content body frames that violate the protocol's framing constraints. The amqp091-go client before v1.13.0 accepts this value without enforcing the specification minimum, triggering unbounded heap allocation as the client processes the malformed frames, ultimately exhausting process memory and crashing the application. … |
| Remediation | Upgrade amqp091-go to version 1.13.0, the vendor-released patch confirmed at https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Go applications and infrastructure components using amqp091-go by checking dependencies and deployment manifests. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today