CVE-2026-79921CWE-770denial-of-service

CVE-2026-79921

published August 27, 2026

CVSS
8.9
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.

The record
Technical detail
CVSS
8.9 · NONE
CVSS v4.0
8.9 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
EPSS
0.00550 · 45.2th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-08-27T01:16Z
References (4)
https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0 · [email protected]https://github.com/rabbitmq/amqp091-go/pull/353 · [email protected]https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0 · [email protected]https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp · [email protected]
EPSS history
Timeline
  • 28 AUG 06:53Z
    EPSS moved — → 0%
    epss
  • 26 AUG 20:24Z
    amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
    cvelistv5