CVE-2026-77403
RabbitMQ amqp091-go client accepts a FrameMax below the AMQP minimum
Technology
RabbitMQ
CVSS Score
8.9 / 10.0
Affected Versions
amqp091-go before 1.13.0
Upstream Fix
amqp091-go 1.13.0
Published
September 16, 2026
OSSeva Coverage
Fixed upstream
Description
Connection negotiation accepts a server-advertised FrameMax below the 4096-byte protocol minimum. A malicious or compromised broker can advertise a tiny value so that every later publication is split into a very large number of frames and writes, consuming CPU and stalling the client or its host.
Is your RabbitMQ deployment affected?
If you're running amqp091-go before 1.13.0, you need this patch. Book a discovery call to get covered.
Get a quote
Running RabbitMQ amqp091-go before 1.13.0?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?