Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-16T14:36:19 github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via AMQP frame size negotiation 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-839

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP broker can therefore advertise an extremely small FrameMax, causing later client publications to be fragmented into excessive numbers of frames and write operations. This can consume CPU and stall the client or its host. This issue is fixed in version 1.13.0.

A flaw was found in RabbitMQ amqp091-go, a Go AMQP 0.9.1 client. A malicious or compromised AMQP broker can exploit this by advertising an extremely small frame size during connection negotiation. This can lead to excessive fragmentation of client publications, consuming significant CPU resources and potentially causing a Denial of Service (DoS) by stalling the client or its host.

To mitigate this issue, ensure that applications using the RabbitMQ amqp091-go client only connect to trusted AMQP brokers. Restrict network access for clients to only communicate with known, secure broker instances. This reduces the risk of a malicious or compromised broker exploiting the client's vulnerability during frame size negotiation. Red Hat Hardened Images 2026-09-16T00:00:00Z RHSA-2026:68290 opentelemetry-collector-contrib-main-0.161.0-0.1.hum1 Cryostat 4 Affected cryostat/cryostat-storage-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Affected custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Affected custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator Multicluster Global Hub Affected multicluster-globalhub/multicluster-globalhub-grafana-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-plugin-event-sender-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/acm-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/volsync-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/volsync-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso-operators/rabbitmq-cluster-rhel9-operator Red Hat Quay 3 Affected quay/clair-rhel8 Red Hat Quay 3 Affected quay/clair-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-77403 https://nvd.nist.gov/vuln/detail/CVE-2026-77403 https://github.com/rabbitmq/amqp091-go/commit/2e0a919b89f337dbf58db2bb34ab206dac354a06 https://github.com/rabbitmq/amqp091-go/pull/353 https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0 https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-xwwf-m8fg-p9q2