CVE-2026-79921 amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
A malicious AMQP broker can cause memory exhaustion and denial of service in the amqp091-go client by sending oversized payload frames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-79921?
CVE-2026-79921 is a high-severity denial of service vulnerability in rabbitmq amqp091-go, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.
Weakness: CWE-770
Which versions are affected by CVE-2026-79921?
3 open source packages ship an affected version, including github.com/rabbitmq/amqp091-go.
| Package | Affected | Fixed in |
|---|---|---|
github.com/rabbitmq/amqp091-go Go | All versions | 1.13.0 |
github.com/rabbitmq/amqp091-go Go | All versions | 1.13.0 |
github.com/rabbitmq/amqp091-go Go | All versions | 1.13.0 |
Linux distribution packages (1)
opentelemetry-collector-contrib Red Hat:hummingbird:1 | All versions | 0:0.159.0-0.1.1.hum1 |
How do I fix CVE-2026-79921?
Upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-79921 being exploited?
There is no known exploitation of CVE-2026-79921 in the wild and no public exploit code.
Sources
Also known as AZL-98201, AZL-98214, CLEANSTART-2026-FG67434, CLEANSTART-2026-KZ39555, CLEANSTART-2026-NH00645, DEBIAN-CVE-2026-79921 and 42 more.