Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-16T14:39:08 github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via unbounded body buffer allocation 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header.Size value supplied by an AMQP content header without capping the allocation to the negotiated Connection.Config.FrameSize value. A malicious or compromised broker can send an extreme declared body size and cause the Go runtime to attempt a correspondingly large allocation before body data is received. The allocation can exhaust memory and terminate the client process. This issue is fixed in version 1.13.0.

A flaw was found in RabbitMQ amqp091-go. A malicious or compromised broker can send an extreme declared message body size to a client. This causes the client to attempt an excessively large memory allocation without proper size capping, leading to memory exhaustion and termination of the client process. This vulnerability results in a Denial of Service (DoS).

Red Hat Hardened Images 2026-09-16T00:00:00Z RHSA-2026:68290 opentelemetry-collector-contrib-main-0.161.0-0.1.hum1 Cryostat 4 Not affected cryostat/cryostat-storage-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Affected custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Affected custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator Multicluster Global Hub Affected multicluster-globalhub/multicluster-globalhub-grafana-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-plugin-event-sender-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Under investigation redhat-user-workloads/grafana-acm-213 Red Hat Advanced Cluster Management for Kubernetes 2 Under investigation redhat-user-workloads/volsync-0-12 Red Hat Advanced Cluster Management for Kubernetes 2 Under investigation redhat-user-workloads/volsync-bundle-0-12 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/acm-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/volsync-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/volsync-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso-operators/rabbitmq-cluster-rhel9-operator Red Hat Quay 3 Affected quay/clair-rhel8 Red Hat Quay 3 Affected quay/clair-rhel9 Red Hat Quay 3 Under investigation redhat-user-workloads/quay-clair-v3-9 https://www.cve.org/CVERecord?id=CVE-2026-77410 https://nvd.nist.gov/vuln/detail/CVE-2026-77410 https://github.com/rabbitmq/amqp091-go/commit/91b65fa0096a99a580cf51a31b24028ff1c60382 https://github.com/rabbitmq/amqp091-go/pull/346 https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0 https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-r9c8-gcjp-xfwh