---
id: "CVE-2026-77403"
kind: "vulnerability"
aliases: ["CVE-2026-77403", "GHSA-xwwf-m8fg-p9q2", "GO-2026-6503"]
title: "RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation in github.com/rabbitmq/amqp091-go"
severity: "high"
cvss: 8.9
epss: 0.00524
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/rabbitmq/amqp091-go", "fixed": ["1.13.0"], "affected": "< 1.13.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["amqp", "go", "package", "rabbitmq"]
not_affected_if: ["no-untrusted-broker"]
published_at: "2026-09-16T15:17:46+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:43:51+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6503", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-77403", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77403", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation in github.com/rabbitmq/amqp091-go

A Go AMQP 0.9.1 client accepts a FrameMax value below the protocol minimum of 4096 bytes from the broker during connection setup. A malicious or compromised broker can make the client fragment every publish into a huge number of tiny frames, burning CPU and stalling the client or its host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/rabbitmq/amqp091-go affected < 1.13.0 fixed 1.13.0

## How to check

Check go.mod or go.sum for github.com/rabbitmq/amqp091-go with a version below 1.13.0.

## Fix

Upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6503
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-77403
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77403

## From the sources

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP broker can therefore advertise an extremely small FrameMax, causing later client publications to be fragmented into excessive numbers of frames and write operations. This can consume CPU and stall the client or its host. This issue is fixed in version 1.13.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_