EUVD-2026-80822Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but conditional on unbuffered listener channels plus broker event bursts (AT:P → AC:H); pure availability impact with no confidentiality or integrity effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.dispatch in channel.go, confirms.confirm in confirms.go, and Connection.dispatch0 in connection.go synchronously send publisher confirmations, flow-control events, consumer cancellations, returned messages, including NotifyConfirm events and connection block notifications, to application-provided channels. If a listener channel is unbuffered, full, or not drained promptly, the sole reader goroutine blocks and stops processing frames, acknowledgments, deliveries, and heartbeats. Broker-driven event bursts can therefore cause connection stalls, missed heartbeats, deadlocks, and disconnection. This issue is fixed in version 1.13.0.
AnalysisAI
Denial of service in the RabbitMQ amqp091-go Go AMQP 0.9.1 client affects all releases prior to 1.13.0: the library's frame-dispatch path synchronously pushes publisher confirms, flow-control events, consumer cancellations, returned messages and connection-block notifications into application-registered listener channels, so an unbuffered, undersized or not-promptly-drained listener channel permanently blocks the connection's sole reader goroutine. Once that goroutine stalls, the client stops processing incoming frames, acknowledgments, deliveries and heartbeats, which leads to connection stalls, missed heartbeats, deadlocks and eventual broker-initiated disconnection; exploitation requires a broker-driven burst of the corresponding events against an application that registered an affected listener, rather than any attacker-supplied payload. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the application to be built on amqp091-go prior to 1.13.0 AND to register one or more notification listeners - NotifyPublish/publisher confirms, NotifyFlow (flow-control), NotifyCancel (consumer cancellation), NotifyReturn (returned messages), or NotifyBlocked (connection block) - backed by an unbuffered, undersized, or not-promptly-drained Go channel. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a client-library denial-of-service issue in the RabbitMQ amqp091-go Go client (CWE-770), and the signals are internally consistent but modest in real severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: amqp091-go v1.13.0 - upgrade every Go module, vendored copy and container image that depends on github.com/rabbitmq/amqp091-go to 1.13.0 or later (release notes: https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0; fix PR https://github.com/rabbitmq/amqp091-go/pull/349; commit https://github.com/rabbitmq/amqp091-go/commit/5b0ccbb8d7bc3dfa18129d9b0f9256d656809494; advisory https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-wxx3-cj7g-w73j); run `go list -m -u all` or `govulncheck` to confirm no transitive dependency still pins an older version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Go service and transitive dependency in the portfolio that uses github.com/rabbitmq/amqp091-go below 1.13.0 (run go list -m all or scan all go.mod/go.sum files) and rank services that carry payments, order, fulfillment, or customer-notification traffic through RabbitMQ as the first remediation tier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed UR
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query p
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today