Vulnerability-Lookup

CVE-2026-107386 (GCVE-0-2026-107386)

Vulnerability from cvelistv5 – Published: 2026-10-08 18:54 – Updated: 2026-10-09 15:14

Title

amqp091-go: Pre-negotiation frame limit is not enforced to 4KB

Summary

amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer can send a short body-frame header with a large declared payload length, causing ReadFrame and the body-frame parser to allocate attacker-selected memory before the payload is received or the frame's protocol state is rejected. The condition is reachable through public Open even when Config.FrameSize is set to the protocol minimum and can cause severe memory pressure, out-of-memory termination, or loss of the client process before authentication completes. This issue is fixed in version 1.14.0.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 20:23 UTC

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7640 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/rabbitmq/amqp091-go/security/a…	x_refsource_CONFIRM
https://github.com/rabbitmq/amqp091-go/pull/377	x_refsource_MISC
https://github.com/rabbitmq/amqp091-go/commit/672…	x_refsource_MISC
https://github.com/rabbitmq/amqp091-go/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
rabbitmq	amqp091-go	Affected: >= 1.13.0, < 1.14.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107386",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T20:23:14.862830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T15:14:35.548Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "amqp091-go",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.14.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer can send a short body-frame header with a large declared payload length, causing ReadFrame and the body-frame parser to allocate attacker-selected memory before the payload is received or the frame\u0027s protocol state is rejected. The condition is reachable through public Open even when Config.FrameSize is set to the protocol minimum and can cause severe memory pressure, out-of-memory termination, or loss of the client process before authentication completes. This issue is fixed in version 1.14.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T18:54:12.465Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-w6r9-248c-frg8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-w6r9-248c-frg8"
        },
        {
          "name": "https://github.com/rabbitmq/amqp091-go/pull/377",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/pull/377"
        },
        {
          "name": "https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3"
        },
        {
          "name": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.14.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.14.0"
        }
      ],
      "source": {
        "advisory": "GHSA-w6r9-248c-frg8",
        "discovery": "UNKNOWN"
      },
      "title": "amqp091-go: Pre-negotiation frame limit is not enforced to 4KB"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107386",
    "datePublished": "2026-10-08T18:54:12.465Z",
    "dateReserved": "2026-10-07T21:07:54.988Z",
    "dateUpdated": "2026-10-09T15:14:35.548Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-107386",
      "date": "2026-10-10",
      "epss": "0.00493",
      "percentile": "0.40492"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "amqp091-go",
                "vendor": "rabbitmq",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 1.13.0, \u003c 1.14.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer can send a short body-frame header with a large declared payload length, causing ReadFrame and the body-frame parser to allocate attacker-selected memory before the payload is received or the frame\u0027s protocol state is rejected. The condition is reachable through public Open even when Config.FrameSize is set to the protocol minimum and can cause severe memory pressure, out-of-memory termination, or loss of the client process before authentication completes. This issue is fixed in version 1.14.0."
          }
        ],
        "id": "CVE-2026-107386",
        "lastModified": "2026-10-09T16:17:22.590",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-107386",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T20:23:14.862830Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-08T19:17:01.347",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rabbitmq/amqp091-go/pull/377"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.14.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-w6r9-248c-frg8"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-09T23:27:20+00:00",
      "cve": "CVE-2026-107386",
      "id": "CVE-2026-107386",
      "initial_release_date": "2026-10-08T18:54:12.465000+00:00",
      "product_status:fixed": "3",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "11",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via excessive memory allocation during frame parsing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-107386.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-107386",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-08T20:23:14.862830Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-08T20:23:15.630Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "amqp091-go",
              "vendor": "rabbitmq",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 1.13.0, \u003c 1.14.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer can send a short body-frame header with a large declared payload length, causing ReadFrame and the body-frame parser to allocate attacker-selected memory before the payload is received or the frame\u0027s protocol state is rejected. The condition is reachable through public Open even when Config.FrameSize is set to the protocol minimum and can cause severe memory pressure, out-of-memory termination, or loss of the client process before authentication completes. This issue is fixed in version 1.14.0."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "LOW",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-770",
                  "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-08T18:54:12.465Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-w6r9-248c-frg8",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-w6r9-248c-frg8"
            },
            {
              "name": "https://github.com/rabbitmq/amqp091-go/pull/377",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rabbitmq/amqp091-go/pull/377"
            },
            {
              "name": "https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3"
            },
            {
              "name": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.14.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.14.0"
            }
          ],
          "source": {
            "advisory": "GHSA-w6r9-248c-frg8",
            "discovery": "UNKNOWN"
          },
          "title": "amqp091-go: Pre-negotiation frame limit is not enforced to 4KB"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-107386",
        "datePublished": "2026-10-08T18:54:12.465Z",
        "dateReserved": "2026-10-07T21:07:54.988Z",
        "dateUpdated": "2026-10-08T18:54:12.465Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-107386

Vulnerability from fkie_nvd - Published: 2026-10-08 19:17 - Updated: 2026-10-09 16:17

Severity

6.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3
	security-advisories@github.com	https://github.com/rabbitmq/amqp091-go/pull/377
	security-advisories@github.com	https://github.com/rabbitmq/amqp091-go/releases/tag/v1.14.0
	security-advisories@github.com	https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-w6r9-248c-frg8

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "amqp091-go",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.13.0, \u003c 1.14.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer can send a short body-frame header with a large declared payload length, causing ReadFrame and the body-frame parser to allocate attacker-selected memory before the payload is received or the frame\u0027s protocol state is rejected. The condition is reachable through public Open even when Config.FrameSize is set to the protocol minimum and can cause severe memory pressure, out-of-memory termination, or loss of the client process before authentication completes. This issue is fixed in version 1.14.0."
    }
  ],
  "id": "CVE-2026-107386",
  "lastModified": "2026-10-09T16:17:22.590",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-107386",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-08T20:23:14.862830Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-08T19:17:01.347",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rabbitmq/amqp091-go/pull/377"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.14.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-w6r9-248c-frg8"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-W6R9-248C-FRG8

Vulnerability from github – Published: 2026-10-08 19:40 – Updated: 2026-10-08 19:40

Summary

amqp091-go: Pre-negotiation frame limit is not enforced to 4KB

Details

Summary

The frame-size mitigation released in amqp091-go v1.13.0 can be bypassed before connection.tune completes. A malicious or compromised AMQP peer can send only a seven-byte body-frame header containing a large attacker-controlled uint32 payload length. The client allocates a slice of that declared length before it verifies that the payload exists or rejects the frame for its invalid protocol state.

The bypass occurs because Connection.maxFrameSize starts at zero. The reader interprets zero as both “negotiated unlimited” and “not negotiated yet,” and skips the pre-allocation size check in either case. Open starts the reader goroutine before negotiation and does not store a limit until after it receives connection.tune.

This remains reachable even if the caller explicitly uses Config{FrameSize: frameMinSize}. A malicious broker can therefore cause excessive memory allocation, potentially terminating the Go client process through memory exhaustion, before authentication and connection setup complete.

Relationship to the existing advisory

GHSA-r9c8-gcjp-xfwh describes attacker-controlled, unbounded allocation by a malicious broker and identifies v1.13.0 as the patched version. Pull request 369 added a frame-size check before parser allocation, but the check is active only when the stored maximum is nonzero.

The v1.13.0 source still:

starts the reader before protocol negotiation;
skips the bound while maxFrameSize == 0;
allocates the body using the peer-declared size; and
stores the negotiated maximum only after connection.tune.

This appears to be an incomplete-fix or state-boundary bypass of the existing advisory rather than an unrelated allocation issue.

Affected source and root cause

The issue was reproduced at commit 9313fd9ea47bdb4e8f7f5db9bef94d5534d0bdde, dated 2026-07-30. The same relevant control flow is in the v1.13.0 tag.

The vulnerable sequence is:

The source comments and regression tests explicitly combine “negotiated unlimited” with “not yet negotiated” as the same zero state. Those states need different security behavior.

Safe reproduction

This reproducer does not start RabbitMQ, contact any hosted service, send a large payload, or attempt to crash the process. It declares a 2 MiB body and observes the size of the slice passed to the transport's payload Read. Receiving a 2 MiB destination slice proves that the allocation occurred; the test then releases the blocked read and exits.

Check out v1.13.0.
Save the following as pre_negotiation_frame_limit_test.go in the repository root.
Run go test -run '^TestPreNegotiationFrameLimitBypass$' -count=1 -v ..

package amqp091

import (
    "encoding/binary"
    "io"
    "sync"
    "testing"
    "time"
)

const declaredBodySize = 2 << 20

type stagedFrameConn struct {
    mu          sync.Mutex
    header      []byte
    headerRead  bool
    bodyRead    chan int
    bodyOnce    sync.Once
    release     chan struct{}
    releaseOnce sync.Once
}

func newStagedFrameConn() *stagedFrameConn {
    header := make([]byte, 7)
    header[0] = frameBody
    binary.BigEndian.PutUint16(header[1:3], 1)
    binary.BigEndian.PutUint32(header[3:7], declaredBodySize)
    return &stagedFrameConn{
        header:   header,
        bodyRead: make(chan int, 1),
        release:  make(chan struct{}),
    }
}

func (c *stagedFrameConn) Read(p []byte) (int, error) {
    c.mu.Lock()
    if !c.headerRead {
        c.headerRead = true
        n := copy(p, c.header)
        c.mu.Unlock()
        return n, nil
    }
    c.mu.Unlock()

    c.bodyOnce.Do(func() { c.bodyRead <- len(p) })
    <-c.release
    return 0, io.EOF
}

func (c *stagedFrameConn) Write(p []byte) (int, error) { return len(p), nil }

func (c *stagedFrameConn) Close() error {
    c.releaseOnce.Do(func() { close(c.release) })
    return nil
}

func TestPreNegotiationFrameLimitBypass(t *testing.T) {
    conn := newStagedFrameConn()
    openDone := make(chan error, 1)

    go func() {
        _, err := Open(conn, Config{FrameSize: frameMinSize})
        openDone <- err
    }()

    select {
    case got := <-conn.bodyRead:
        if got != declaredBodySize {
            t.Fatalf("payload Read received a %d-byte slice; want %d", got, declaredBodySize)
        }
    case <-time.After(5 * time.Second):
        t.Fatal("payload Read was not reached")
    }

    _ = conn.Close()
    select {
    case <-openDone:
    case <-time.After(5 * time.Second):
        t.Fatal("Open did not exit after the test connection closed")
    }
}

Expected secure behavior

The pre-negotiation reader rejects the oversized declared frame before allocating its payload buffer. The transport should never receive a payload Read with a 2 MiB destination slice.

Actual behavior

The test passes because the transport receives a payload Read whose destination slice is exactly 2 MiB, despite the caller setting Config.FrameSize to frameMinSize. This slice was created by make([]byte, size) using the untrusted frame header.

Additional local validation

A five-test differential harness was run against the exact tested commit. All tests passed:

=== RUN   TestCounterfactualZeroFrameLimitAllocatesBeforePayloadRead
--- PASS: TestCounterfactualZeroFrameLimitAllocatesBeforePayloadRead
=== RUN   TestCounterfactualNegotiatedLimitRejectsBeforePayloadAllocation
--- PASS: TestCounterfactualNegotiatedLimitRejectsBeforePayloadAllocation
=== RUN   TestCounterfactualZeroLimitAllowsSmallFrameControl
--- PASS: TestCounterfactualZeroLimitAllowsSmallFrameControl
=== RUN   TestCounterfactualNegotiatedLimitAllowsSmallFrameControl
--- PASS: TestCounterfactualNegotiatedLimitAllowsSmallFrameControl
=== RUN   TestCounterfactualPublicOpenReachesZeroLimitAllocation
--- PASS: TestCounterfactualPublicOpenReachesZeroLimitAllocation
PASS
ok github.com/rabbitmq/amqp091-go 0.907s

The controls establish that:

the zero pre-negotiation state reaches attacker-sized allocation;
a frameMinSize bound rejects the same declaration before allocation;
both states continue to accept a valid small frame; and
the vulnerable state is reachable through public Open, not only through an internal helper.

Impact

The frame body length is a network-controlled 32-bit unsigned integer, so one seven-byte frame header can request an allocation approaching 4 GiB on a 64-bit client. The attacker does not need to transmit the declared body before allocation occurs. On memory-constrained clients or containers, this can cause severe memory pressure, an out-of-memory condition, or process termination.

The required attacker position is a malicious or compromised broker, or an equivalent peer able to provide the AMQP transport during connection establishment. No application credentials, user interaction, confidentiality impact, or integrity impact is required or claimed. The primary impact is availability of the client process and potentially dependent services.

Protocol relevance

The AMQP 0-9-1 reference requires peers to accept frames up to the 4096-byte frame-min-size before frame-max is negotiated. It does not require accepting arbitrarily large pre-negotiation frames. A provisional 4096-byte receive limit is therefore compatible with the stated pre-negotiation requirement.

Suggested remediation

Represent these states separately:

pre-negotiation, with a provisional frameMinSize receive bound;
negotiated with a finite frame_max; and
explicitly negotiated unlimited, if that behavior remains supported.

Initialize the provisional bound before the reader goroutine starts, then replace it with the negotiated result after connection.tune. Reject any declared payload that would make the total frame exceed the active limit before calling a frame parser or allocating a payload buffer. A protocol-state check that rejects body frames before connection setup completes would add defense in depth.

Please add a regression through public Open that sends an oversized body-frame header before connection.tune and verifies rejection before payload allocation, while retaining small valid-frame controls.

Severity

6.3 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rabbitmq/amqp091-go"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.14.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-107386"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-08T19:40:19Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\nThe frame-size mitigation released in `amqp091-go` v1.13.0 can be bypassed before `connection.tune` completes. A malicious or compromised AMQP peer can send only a seven-byte body-frame header containing a large attacker-controlled `uint32` payload length. The client allocates a slice of that declared length before it verifies that the payload exists or rejects the frame for its invalid protocol state.\n\nThe bypass occurs because `Connection.maxFrameSize` starts at zero. The reader interprets zero as both \u201cnegotiated unlimited\u201d and \u201cnot negotiated yet,\u201d and skips the pre-allocation size check in either case. `Open` starts the reader goroutine before negotiation and does not store a limit until after it receives `connection.tune`.\n\nThis remains reachable even if the caller explicitly uses `Config{FrameSize: frameMinSize}`. A malicious broker can therefore cause excessive memory allocation, potentially terminating the Go client process through memory exhaustion, before authentication and connection setup complete.\n\n## Relationship to the existing advisory\n\n[GHSA-r9c8-gcjp-xfwh](https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-r9c8-gcjp-xfwh) describes attacker-controlled, unbounded allocation by a malicious broker and identifies v1.13.0 as the patched version. [Pull request 369](https://github.com/rabbitmq/amqp091-go/pull/369) added a frame-size check before parser allocation, but the check is active only when the stored maximum is nonzero.\n\nThe v1.13.0 source still:\n\n1. starts the reader before protocol negotiation;\n2. skips the bound while `maxFrameSize == 0`;\n3. allocates the body using the peer-declared size; and\n4. stores the negotiated maximum only after `connection.tune`.\n\nThis appears to be an incomplete-fix or state-boundary bypass of the existing advisory rather than an unrelated allocation issue.\n\n## Affected source and root cause\n\nThe issue was reproduced at commit [`9313fd9ea47bdb4e8f7f5db9bef94d5534d0bdde`](https://github.com/rabbitmq/amqp091-go/commit/9313fd9ea47bdb4e8f7f5db9bef94d5534d0bdde), dated 2026-07-30. The same relevant control flow is in the v1.13.0 tag.\n\nThe vulnerable sequence is:\n\n1. [`Open` starts `c.reader(conn)` before calling `c.open(config)`](https://github.com/rabbitmq/amqp091-go/blob/9313fd9ea47bdb4e8f7f5db9bef94d5534d0bdde/connection.go#L373-L392).\n2. [The reader receives a pointer to the initially zero-valued `c.maxFrameSize`](https://github.com/rabbitmq/amqp091-go/blob/9313fd9ea47bdb4e8f7f5db9bef94d5534d0bdde/connection.go#L971-L979).\n3. [`ReadFrame` decodes the peer-controlled `uint32` size but rejects it only when `max \u003e 0`](https://github.com/rabbitmq/amqp091-go/blob/9313fd9ea47bdb4e8f7f5db9bef94d5534d0bdde/read.go#L46-L79).\n4. [`parseBodyFrame` executes `make([]byte, size)` before `io.ReadFull`](https://github.com/rabbitmq/amqp091-go/blob/9313fd9ea47bdb4e8f7f5db9bef94d5534d0bdde/read.go#L459-L466).\n5. [`maxFrameSize` is first stored after processing `connection.tune`](https://github.com/rabbitmq/amqp091-go/blob/9313fd9ea47bdb4e8f7f5db9bef94d5534d0bdde/connection.go#L1297-L1305).\n\nThe source comments and regression tests explicitly combine \u201cnegotiated unlimited\u201d with \u201cnot yet negotiated\u201d as the same zero state. Those states need different security behavior.\n\n## Safe reproduction\n\nThis reproducer does not start RabbitMQ, contact any hosted service, send a large payload, or attempt to crash the process. It declares a 2 MiB body and observes the size of the slice passed to the transport\u0027s payload `Read`. Receiving a 2 MiB destination slice proves that the allocation occurred; the test then releases the blocked read and exits.\n\n1. Check out v1.13.0.\n2. Save the following as `pre_negotiation_frame_limit_test.go` in the repository root.\n3. Run `go test -run \u0027^TestPreNegotiationFrameLimitBypass$\u0027 -count=1 -v .`.\n\n```go\npackage amqp091\n\nimport (\n\t\"encoding/binary\"\n\t\"io\"\n\t\"sync\"\n\t\"testing\"\n\t\"time\"\n)\n\nconst declaredBodySize = 2 \u003c\u003c 20\n\ntype stagedFrameConn struct {\n\tmu          sync.Mutex\n\theader      []byte\n\theaderRead  bool\n\tbodyRead    chan int\n\tbodyOnce    sync.Once\n\trelease     chan struct{}\n\treleaseOnce sync.Once\n}\n\nfunc newStagedFrameConn() *stagedFrameConn {\n\theader := make([]byte, 7)\n\theader[0] = frameBody\n\tbinary.BigEndian.PutUint16(header[1:3], 1)\n\tbinary.BigEndian.PutUint32(header[3:7], declaredBodySize)\n\treturn \u0026stagedFrameConn{\n\t\theader:   header,\n\t\tbodyRead: make(chan int, 1),\n\t\trelease:  make(chan struct{}),\n\t}\n}\n\nfunc (c *stagedFrameConn) Read(p []byte) (int, error) {\n\tc.mu.Lock()\n\tif !c.headerRead {\n\t\tc.headerRead = true\n\t\tn := copy(p, c.header)\n\t\tc.mu.Unlock()\n\t\treturn n, nil\n\t}\n\tc.mu.Unlock()\n\n\tc.bodyOnce.Do(func() { c.bodyRead \u003c- len(p) })\n\t\u003c-c.release\n\treturn 0, io.EOF\n}\n\nfunc (c *stagedFrameConn) Write(p []byte) (int, error) { return len(p), nil }\n\nfunc (c *stagedFrameConn) Close() error {\n\tc.releaseOnce.Do(func() { close(c.release) })\n\treturn nil\n}\n\nfunc TestPreNegotiationFrameLimitBypass(t *testing.T) {\n\tconn := newStagedFrameConn()\n\topenDone := make(chan error, 1)\n\n\tgo func() {\n\t\t_, err := Open(conn, Config{FrameSize: frameMinSize})\n\t\topenDone \u003c- err\n\t}()\n\n\tselect {\n\tcase got := \u003c-conn.bodyRead:\n\t\tif got != declaredBodySize {\n\t\t\tt.Fatalf(\"payload Read received a %d-byte slice; want %d\", got, declaredBodySize)\n\t\t}\n\tcase \u003c-time.After(5 * time.Second):\n\t\tt.Fatal(\"payload Read was not reached\")\n\t}\n\n\t_ = conn.Close()\n\tselect {\n\tcase \u003c-openDone:\n\tcase \u003c-time.After(5 * time.Second):\n\t\tt.Fatal(\"Open did not exit after the test connection closed\")\n\t}\n}\n```\n\n### Expected secure behavior\n\nThe pre-negotiation reader rejects the oversized declared frame before allocating its payload buffer. The transport should never receive a payload `Read` with a 2 MiB destination slice.\n\n### Actual behavior\n\nThe test passes because the transport receives a payload `Read` whose destination slice is exactly 2 MiB, despite the caller setting `Config.FrameSize` to `frameMinSize`. This slice was created by `make([]byte, size)` using the untrusted frame header.\n\n## Additional local validation\n\nA five-test differential harness was run against the exact tested commit. All tests passed:\n\n```text\n=== RUN   TestCounterfactualZeroFrameLimitAllocatesBeforePayloadRead\n--- PASS: TestCounterfactualZeroFrameLimitAllocatesBeforePayloadRead\n=== RUN   TestCounterfactualNegotiatedLimitRejectsBeforePayloadAllocation\n--- PASS: TestCounterfactualNegotiatedLimitRejectsBeforePayloadAllocation\n=== RUN   TestCounterfactualZeroLimitAllowsSmallFrameControl\n--- PASS: TestCounterfactualZeroLimitAllowsSmallFrameControl\n=== RUN   TestCounterfactualNegotiatedLimitAllowsSmallFrameControl\n--- PASS: TestCounterfactualNegotiatedLimitAllowsSmallFrameControl\n=== RUN   TestCounterfactualPublicOpenReachesZeroLimitAllocation\n--- PASS: TestCounterfactualPublicOpenReachesZeroLimitAllocation\nPASS\nok github.com/rabbitmq/amqp091-go 0.907s\n```\n\nThe controls establish that:\n\n- the zero pre-negotiation state reaches attacker-sized allocation;\n- a `frameMinSize` bound rejects the same declaration before allocation;\n- both states continue to accept a valid small frame; and\n- the vulnerable state is reachable through public `Open`, not only through an internal helper.\n\n## Impact\n\nThe frame body length is a network-controlled 32-bit unsigned integer, so one seven-byte frame header can request an allocation approaching 4 GiB on a 64-bit client. The attacker does not need to transmit the declared body before allocation occurs. On memory-constrained clients or containers, this can cause severe memory pressure, an out-of-memory condition, or process termination.\n\nThe required attacker position is a malicious or compromised broker, or an equivalent peer able to provide the AMQP transport during connection establishment. No application credentials, user interaction, confidentiality impact, or integrity impact is required or claimed. The primary impact is availability of the client process and potentially dependent services.\n\n## Protocol relevance\n\nThe [AMQP 0-9-1 reference](https://github.com/rabbitmq/amqp-0.9.1-spec/blob/main/docs/amqp-0-9-1-reference.md#L395-L398) requires peers to accept frames up to the 4096-byte `frame-min-size` before `frame-max` is negotiated. It does not require accepting arbitrarily large pre-negotiation frames. A provisional 4096-byte receive limit is therefore compatible with the stated pre-negotiation requirement.\n\n## Suggested remediation\n\nRepresent these states separately:\n\n- pre-negotiation, with a provisional `frameMinSize` receive bound;\n- negotiated with a finite `frame_max`; and\n- explicitly negotiated unlimited, if that behavior remains supported.\n\nInitialize the provisional bound before the reader goroutine starts, then replace it with the negotiated result after `connection.tune`. Reject any declared payload that would make the total frame exceed the active limit before calling a frame parser or allocating a payload buffer. A protocol-state check that rejects body frames before connection setup completes would add defense in depth.\n\nPlease add a regression through public `Open` that sends an oversized body-frame header before `connection.tune` and verifies rejection before payload allocation, while retaining small valid-frame controls.",
  "id": "GHSA-w6r9-248c-frg8",
  "modified": "2026-10-08T19:40:19Z",
  "published": "2026-10-08T19:40:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-w6r9-248c-frg8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/pull/377"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rabbitmq/amqp091-go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.14.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "amqp091-go: Pre-negotiation frame limit is not enforced to 4KB"
}

RHSA-2026:80217

Vulnerability from csaf_redhat - Published: 2026-10-09 21:24 - Updated: 2026-10-09 23:27

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Severity

Important

Scope

2 vulnerabilities in this advisory, including CVE-2026-107386.

CVE-2026-107386

A flaw was found in amqp091-go. A malicious server or remote peer can cause a Denial of Service (DoS) by sending a crafted frame header declaring an excessively large payload size during initial connection setup. This flaw causes the client to allocate large amounts of memory before validating the frame or completing authentication, resulting in memory exhaustion and termination of the client process.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:80217

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-107386 (GCVE-0-2026-107386)

FKIE_CVE-2026-107386

GHSA-W6R9-248C-FRG8

Summary

Relationship to the existing advisory

Affected source and root cause

Safe reproduction

Expected secure behavior

Actual behavior

Additional local validation

Impact

Protocol relevance

Suggested remediation

RHSA-2026:80217

Tags

Sightings

Nomenclature

Related by attack behaviour