CVE-2026-107386

MediumCVSS 6.3

Published: 08/10/2026(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.49%

40th percentile - higher than 40% of all known CVEs

Summary

In the amqp091-go library (Go AMQP 0.9.1 client) from version 1.13.0 to 1.14.0, the frame-size mitigation can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer can send a short body-frame header with a large declared payload length, causing memory allocation before the payload is received or the frame's protocol state is rejected. This issue is fixed in version 1.14.0.

Risk Assessment

An attacker can cause severe memory pressure, out-of-memory termination, or loss of the client process before authentication completes, leading to denial of service.

Recommendation

Upgrade amqp091-go to version 1.14.0 or later to remediate the vulnerability.

Other vulnerabilities in amqp091-go

CVE-2026-79921High
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a malicious AMQP broker can force the client to allocate resources and process content body frames exceeding the frame_max limit. This can lead to unexpected memory consumption or application-layer DoS, bypassing protocol constraints. Version 1.13.0 contains a fix. No workarounds are known.

Original NVD description (English source)

amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer can send a short body-frame header with a large declared payload length, causing ReadFrame and the body-frame parser to allocate attacker-selected memory before the payload is received or the frame's protocol state is rejected. The condition is reachable through public Open even when Config.FrameSize is set to the protocol minimum and can cause severe memory pressure, out-of-memory termination, or loss of the client process before authentication completes. This issue is fixed in version 1.14.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS