Most recent entries from all

CLEANSTART-2026-QD76067 — RabbitMQ amqp091-go is a Go AMQP 0

2026-09-30T05:30:51.523055+00:00

Affected: CleanStart: opentelemetry-collector-contrib

Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0.

fkie_cve-2026-77403

2026-09-30T05:30:51.523137+00:00

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP broker can therefore advertise an extremely small FrameMax, causing later client publications to be fragmented into excessive numbers of frames and write operations. This can consume CPU and stall the client or its host. This issue is fixed in version 1.13.0.

GHSA-xwwf-m8fg-p9q2 — RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation

2026-09-30T05:30:51.523190+00:00

Affected: Go: github.com/rabbitmq/amqp091-go

## Summary A Denial of Service (DoS) vulnerability exists in the AMQP client's connection negotiation logic. The AMQP specification explicitly mandates a strict minimum frame size of 4096 bytes to prevent pathological packet fragmentation. While the library defines a `frameMinSize = 4096` constant, the connection negotiation loop fails to enforce this boundary, blindly accepting whatever maximum frame size (`FrameMax`) the server advertises during the handshake.

If a client connects to a malicious or compromised AMQP broker that advertises an extremely low `FrameMax` (such as 1 byte), the negotiation succeeds. Consequently, every subsequent message transmission is forced to splinter into thousands or millions of single-byte frames, causing massive CPU overhead, thread contention, and a near-instantaneous application freeze.

---

## Vulnerability Details

### Mechanism During the connection establishment phase, the client and server negotiate connection parameters—including maximum channel count, heartbeat intervals, and maximum frame sizes. The vulnerability is located where the client accepts the server's tuning parameters:

```go // Connection negotiation logic maps server values directly without validation if serverSettings.FrameMax > 0 { // VULNERABILITY: Lacks a floor validation check against frameMinSize (4096) c.config.FrameMax = serverSettings.FrameMax } ```

Because there is no conditional check asserting that `serverSettings.FrameMax >= frameMinSize`, a…

RHSA-2026:68290 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

2026-09-30T05:30:51.523276+00:00

github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via AMQP frame size negotiation github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Connection configuration overwrite via unsanitized TLS path parameter injection github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via signed-to-unsigned integer casting github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Fields github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service due to synchronous event channel blocking github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via unbounded body buffer allocation github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via Malicious AMQP Field Length go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission

UBUNTU-CVE-2026-77403

2026-09-30T05:30:51.523320+00:00

Affected: Ubuntu:24.04:LTS: golang-github-rabbitmq-amqp091-go, Ubuntu:26.04:LTS: golang-github-rabbitmq-amqp091-go

(RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connec ...)