Live › vulnerability › CVE-2026-77403
Go to dashboardA Go AMQP 0.9.1 client accepts a FrameMax value below the protocol minimum of 4096 bytes from the broker during connection setup. A malicious or compromised broker can make the client fragment every publish into a huge number of tiny frames, burning CPU and stalling the client or its host.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/rabbitmq/amqp091-go | go | < 1.13.0 | 1.13.0 |
Check go.mod or go.sum for github.com/rabbitmq/amqp091-go with a version below 1.13.0.
Upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP broker can therefore advertise an extremely small FrameMax, causing later client publications to be fragmented into excessive numbers of frames and write operations. This can consume CPU and stall the client or its host. This issue is fixed in version 1.13.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-77403")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.