{"id":"GHSA-6c5v-hqjr-5xxp","revision":null,"records":[{"revision":"bf3bb108b37e431082083716c76a2bc3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-79921","aliases":[],"title":"amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload","description":"amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.","state":0,"publishedAt":"2026-08-26T20:24:58.115+00:00","modifiedAt":"2026-08-29T02:50:25.822+00:00","affected":[{"ecosystem":"Vendor product","name":"amqp091-go","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"rabbitmq\",\n                    \"product\": \"amqp091-go\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.13.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","score":8.9,"severity":"HIGH"}],"references":["https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp","https://github.com/rabbitmq/amqp091-go/pull/353","https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-79921","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-79921","identifiers":["CVE-2026-79921"]},"retained":false,"historicalAffected":[]},{"revision":"11bb74625165485c977085296374524a","observedAt":"2026-11-13T17:08:51.285+00:00","statement":{"source":"euvd","id":"EUVD-2026-66715","aliases":["CVE-2026-79921","GHSA-6c5v-hqjr-5xxp"],"title":"amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to …","description":"amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","score":8.9,"severity":null}],"references":["https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp","https://github.com/rabbitmq/amqp091-go/pull/353","https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-66715","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 26, 2026, 8:24:58 PM","dateUpdated":"Aug 29, 2026, 2:50:25 AM"},"relatedAdvisories":[{"id":"RHSA-2026:79546","title":"Red Hat Security Advisory: Red Hat Quay 3.12.23","vulnerabilityIds":["CVE-2026-17106","CVE-2026-49825","CVE-2026-54770","CVE-2026-59879","CVE-2026-77403","CVE-2026-77404","CVE-2026-77406","CVE-2026-77409","CVE-2026-77410","CVE-2026-77412","CVE-2026-79921","CVE-2026-82417","CVE-2026-87776","CVE-2026-94603"]},{"id":"RHSA-2026:60854","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-79921"]},{"id":"RHSA-2026:79366","title":"Red Hat Security Advisory: Red Hat Quay 3.10.27","vulnerabilityIds":["CVE-2026-49825","CVE-2026-54770","CVE-2026-59879","CVE-2026-77403","CVE-2026-77404","CVE-2026-77406","CVE-2026-77409","CVE-2026-77410","CVE-2026-77412","CVE-2026-79921","CVE-2026-82417","CVE-2026-87776"]},{"id":"RHSA-2026:80217","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-79921","CVE-2026-107386"]},{"id":"RHSA-2026:73038","title":"Red Hat Security Advisory: Multicluster Global Hub 1.8.2 security update","vulnerabilityIds":["CVE-2026-17106","CVE-2026-33818","CVE-2026-41178","CVE-2026-42502","CVE-2026-46604","CVE-2026-48586","CVE-2026-50151","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-71235","CVE-2026-71576","CVE-2026-71577","CVE-2026-75762","CVE-2026-77849","CVE-2026-79921","CVE-2026-80220","CVE-2026-80221"]},{"id":"RHSA-2026:67842","title":"Red Hat Security Advisory: Multicluster Global Hub 1.7.3 security update","vulnerabilityIds":["CVE-2026-32282","CVE-2026-33815","CVE-2026-33818","CVE-2026-34040","CVE-2026-46604","CVE-2026-48586","CVE-2026-50151","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-71235","CVE-2026-71576","CVE-2026-71577","CVE-2026-75762","CVE-2026-77849","CVE-2026-79921","CVE-2026-80220","CVE-2026-80221"]},{"id":"RHSA-2026:68515","title":"Red Hat Security Advisory: Multicluster Global Hub 1.8.2 security update","vulnerabilityIds":["CVE-2026-17106","CVE-2026-33818","CVE-2026-41178","CVE-2026-42502","CVE-2026-46604","CVE-2026-48586","CVE-2026-50151","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-71235","CVE-2026-71576","CVE-2026-71577","CVE-2026-75762","CVE-2026-77849","CVE-2026-79921","CVE-2026-80220","CVE-2026-80221"]},{"id":"RHSA-2026:77656","title":"Red Hat Security Advisory: Red Hat Quay 3.9.27","vulnerabilityIds":["CVE-2026-17106","CVE-2026-49825","CVE-2026-54770","CVE-2026-59879","CVE-2026-77403","CVE-2026-77404","CVE-2026-77406","CVE-2026-77409","CVE-2026-77410","CVE-2026-77412","CVE-2026-79921","CVE-2026-82417","CVE-2026-84292","CVE-2026-84394","CVE-2026-87776"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-66715","identifiers":["EUVD-2026-66715","CVE-2026-79921","GHSA-6c5v-hqjr-5xxp"]},"retained":false,"historicalAffected":[]},{"revision":"fe5505f635dd4ae084060d66813651ba","observedAt":"2026-10-25T16:19:10.271+00:00","statement":{"source":"nvd","id":"CVE-2026-79921","aliases":[],"title":"amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to …","description":"amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.","state":0,"publishedAt":"2026-08-26T21:16:41.873+00:00","modifiedAt":"2026-09-09T21:09:13.08+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.9,"severity":"HIGH"}],"references":["https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0","https://github.com/rabbitmq/amqp091-go/pull/353","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0","https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79921","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-770"],"productCriteria":[],"sourceDates":{"published":"2026-08-26T21:16:41.873","lastModified":"2026-09-09T21:09:13.080"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-79921","identifiers":["CVE-2026-79921"]},"retained":false,"historicalAffected":[]},{"revision":"89c11fbabc1a4b239568f73dac9a8d3b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-6c5v-hqjr-5xxp","aliases":["CVE-2026-79921","GO-2026-6372"],"title":"amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload","description":"**Summary**\nA vulnerability exists in the amqp091-go client library where a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints.\n\n**Details**\nDuring a standard AMQP 0-9-1 connection handshake, the client and the broker negotiate a maximum frame size (frame_max), for example, 4096 bytes.\n\nHowever, after negotiation, a malicious broker can send a valid basic.deliver sequence containing a content body frame whose header declares a payload size larger than the negotiated frame_max. Instead of enforcing the agreed-upon limit and closing the connection with a frame-error (as mandated by the AMQP 0-9-1 specification), the amqp091-go client:\n\n1. Accepts the broker-declared oversized frame size.\n2. Allocates memory based on this oversized declaration.\n3. Reads the payload, assembles it into the message, and delivers it to the consumer.\n\n**Impact**\n\n- Denial of Service (DoS): If a broker sends extremely large frame sizes, it can trigger significant memory allocations on the client side, potentially leading to Out-Of-Memory (OOM) crashes.\n- Protocol Violation: The client fails to enforce negotiated connection parameters, trusting the broker implicitly even after constraints have been established.","state":0,"publishedAt":"2026-09-03T20:15:13+00:00","modifiedAt":"2026-09-15T19:10:48.5771971+00:00","affected":[{"ecosystem":"Go","name":"github.com/rabbitmq/amqp091-go","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.13.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp","https://nvd.nist.gov/vuln/detail/CVE-2026-79921","https://github.com/rabbitmq/amqp091-go/pull/353","https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0","https://github.com/rabbitmq/amqp091-go","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"],"sourceUrl":"https://github.com/advisories/GHSA-6c5v-hqjr-5xxp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6c5v-hqjr-5xxp","identifiers":["GHSA-6c5v-hqjr-5xxp","CVE-2026-79921","GO-2026-6372"]},"retained":false,"historicalAffected":[]},{"revision":"2fb135bb294b4fb1b01ccdd2c921c160","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6372","aliases":["CVE-2026-79921","GHSA-6c5v-hqjr-5xxp"],"title":"Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload in github.com/rabbitmq/amqp091-go","description":"Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload in github.com/rabbitmq/amqp091-go","state":0,"publishedAt":"2026-09-15T18:39:25+00:00","modifiedAt":"2026-09-15T19:00:17.0151357+00:00","affected":[{"ecosystem":"Go","name":"github.com/rabbitmq/amqp091-go","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.13.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp","https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0","https://github.com/rabbitmq/amqp091-go/pull/353","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6372","license":"OSV · upstream source license applies","key":"osv:GO-2026-6372","identifiers":["GO-2026-6372","CVE-2026-79921","GHSA-6c5v-hqjr-5xxp"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-14T22:23:25.3649968+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-14T22:23:25.3649968+00:00","lastSuccessAt":"2026-11-14T22:23:25.5243904+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:25.5243923+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-f4305fb3b9417bd97547e9305731a80b9463cd5f49ef853b3cd62960cad53a57-9d76cdc37374a39108af9d8e6d28e9f332b86df6fe9d743ff6a15196e42cc1d5","complete":true,"records":425755,"lastAttemptAt":"2026-11-14T22:23:24.6996834+00:00","lastSuccessAt":"2026-11-14T22:23:24.6584535+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:24.6996834+00:00","snapshotPublishedAt":"2026-11-14T22:18:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-893872a78a5a49b395e1d5e440abfb7e","complete":true,"records":13821,"lastAttemptAt":"2026-11-14T22:24:06.7670242+00:00","lastSuccessAt":"2026-11-14T22:24:06.761+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:24:06.761+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-14T22:23:25.3649968+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-14T22:23:25.3649968+00:00","lastSuccessAt":"2026-11-14T22:23:25.5255142+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:25.5255147+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-22057fabdc264e74ae1f49b63790ef7e","complete":false,"records":13821,"lastAttemptAt":"2026-11-14T22:23:57.7555434+00:00","lastSuccessAt":"2026-11-14T22:23:57.752+00:00","error":"344 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-14T22:23:57.752+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13530,"expectedIdentifiers":13874,"failedIdentifiers":344},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-14T22:23:25.1321415+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:25.1321415+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-14T22:23:24.8437001+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:24.8437001+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-012aff9b2fb349d53e2c4bace6ca57956b6f5f9d82c1dc9fdc1c9b3c738f8977","complete":true,"records":3148,"lastAttemptAt":"2026-11-14T22:23:25.3249929+00:00","lastSuccessAt":"2026-11-14T04:57:03.8279646+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:25.3249929+00:00","snapshotPublishedAt":"2026-11-14T03:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-bfbc75e561bfffdd0ad20c592902934adbd2d0a701402c5539bbccd9991fe78c","complete":true,"records":232472,"lastAttemptAt":"2026-11-14T22:23:24.9477452+00:00","lastSuccessAt":"2026-11-14T21:27:13.9659762+00:00","error":null,"lastVerifiedAt":"2026-11-14T22:23:24.9477452+00:00","snapshotPublishedAt":"2026-11-14T20:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}