CVE-2026-77403

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0

Description A Denial of Service (DoS) issue exists in the connection negotiation logic. The client fails to enforce the AMQP protocol minimum frame size of 4096 bytes, defined by the frameMinSize constant, and blindly accepts the FrameMax value advertised by the server during the handshake. If a client connects to a malicious or compromised AMQP broker that advertises an extremely small FrameMax, subsequent message transmissions are fragmented into an excessive number of frames and write operations. This process occurs within the Connection.openTune() function in connection.go. The resulting massive CPU overhead and resource starvation can stall the client application or the entire host system.

Recommendations Update RabbitMQ amqp091-go to version 1.13.0.