CVE-2026-77403 RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation
A malicious AMQP broker can cause a Go client to stall by advertising an invalidly small frame size, leading to resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77403?
CVE-2026-77403 is a high-severity denial of service vulnerability in rabbitmq amqp091-go, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP broker can therefore advertise an extremely small FrameMax, causing later client publications to be fragmented into excessive numbers of frames and write operations. This can consume CPU and stall the client or its host. This issue is fixed in version 1.13.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-77403?
3 open source packages ship an affected version, including github.com/rabbitmq/amqp091-go.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rabbitmq/amqp091-go Go | All versions | 1.13.0 |
github.com/rabbitmq/amqp091-go Go | All versions | 1.13.0 |
github.com/rabbitmq/amqp091-go Go | All versions | 1.13.0 |
How do I fix CVE-2026-77403?
Upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-77403 being exploited?
There is no known exploitation of CVE-2026-77403 in the wild and no public exploit code.
Sources
Also known as AZL-103209, AZL-103296, CLEANSTART-2026-OK83858, CLEANSTART-2026-QD76067, CLEANSTART-2026-TG71483, DEBIAN-CVE-2026-77403 and 41 more.