CVE-2026-107386 Details
Description
amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer can send a short body-frame header with a large declared payload length, causing ReadFrame and the body-frame parser to allocate attacker-selected memory before the payload is received or the frame's protocol state is rejected. The condition is reachable through public Open even when Config.FrameSize is set to the protocol minimum and can cause severe memory pressure, out-of-memory termination, or loss of the client process before authentication completes. This issue is fixed in version 1.14.0.
A vulnerability exists in the Go AMQP 0.9.1 client library, amqp091-go, specifically in versions 1.13.0 prior to 1.14.0. The issue arises from an incomplete implementation of frame-size mitigation, which can be exploited by a malicious or compromised AMQP peer. Before the connection tuning process is complete, the library's handling of maximum frame size allows for a bypass. The peer can send a body-frame header with a large declared payload length, leading the client to allocate memory based on this length before the payload is actually received or the frame's protocol state is validated. This vulnerability can cause significant memory pressure, potentially leading to out-of-memory conditions and termination of the client process, all before authentication is completed.
Users can upgrade to amqp091-go version 1.14.0 or later, where this vulnerability is fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 8, 2026CISA-ADP
Assessed Oct 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3 | [email protected] | Source CodeVendor |
| https://github.com/rabbitmq/amqp091-go/pull/377 | [email protected] | Source CodeVendor |
| https://github.com/rabbitmq/amqp091-go/releases/tag/v1.14.0 | [email protected] | Release NotesVendor |
| https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-w6r9-248c-frg8 | [email protected] | AdvisoryExploitRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rabbitmq amqp091-go | < 1.14 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 9, 2026 | CVE Modified | CISA-ADP |
| Oct 8, 2026 | New CVE Received | [email protected] |