Bug 2524713 (CVE-2026-79921) - CVE-2026-79921 github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads
Summary: CVE-2026-79921 github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service ...
Keywords:
Status: NEW
Alias: CVE-2026-79921
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-26 21:02 UTC by OSIDB Bzimport
Modified: 2026-09-01 16:49 UTC (History)
24 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-26 21:02:19 UTC 
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.
Note You need to log in before you can comment on or make changes to this bug.