CVE-2026-79921

Received Received - Intake

Memory Exhaustion in amqp091-go AMQP Client

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-79921

Affected Vendors & Products

Vendor	Product	Version / Range
amqp091	amqp091-go	1.13.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects the amqp091-go library, a Go client for AMQP 0.9.1. A malicious or compromised AMQP broker can exploit it to force the client to allocate excessive memory by sending content body frames larger than the agreed frame_max limit. This bypasses protocol framing constraints and may cause unexpected memory consumption or denial of service (DoS).

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal memory usage or unexpected frame processing in AMQP clients. Check if your Go AMQP client version is below 1.13.0. Monitor network traffic for unusually large AMQP frames exceeding negotiated frame_max limits.

Impact Analysis

If you use a vulnerable version of amqp091-go, an attacker controlling the AMQP broker could trigger high memory usage or crash your application, leading to service disruption. This is especially risky in systems where AMQP is used for critical messaging or data processing.

Compliance Impact

This vulnerability could lead to denial of service (DoS) due to excessive memory consumption, which may disrupt services handling sensitive data. For GDPR, this could impact availability of personal data processing systems, potentially violating Article 32 requirements for security and resilience. For HIPAA, it may affect the availability of systems processing protected health information, risking compliance with the Security Rule's integrity and availability standards.

Mitigation Strategies

Update the amqp091-go library to version 1.13.0 or later to address the vulnerability. No known workarounds exist, so upgrading is the only mitigation.

Hi! I’m here to help you understand CVE-2026-79921. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70