No access to your tenant or devices. Every item links to its source. What this means
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.
Read the publisher's advisoryamqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.
Read the publisher's advisoryamqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.
Read the publisher's advisory**Summary** A vulnerability exists in the amqp091-go client library where a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. **Details** During a standard AMQP 0-9-1 connection handshake, the client and the broker negotiate a maximum frame size (frame_max), for example, 4096 bytes. However, after negotiation, a malicious broker can send a valid basic.deliver sequence containing a content body frame whose header declares a payload size larger than the negotiated frame_max. Instead of enforcing the agreed-upon limit and closing the connection with a frame-error (as mandated by the AMQP 0-9-1 specification), the amqp091-go client: 1. Accepts the broker-declared oversized frame size. 2. Allocates memory based on this oversized declaration. 3. Reads the payload, assembles it into the message, and delivers it to the consumer. **Impact** - Denial of Service (DoS): If a broker sends extremely large frame sizes, it can trigger significant memory allocations on the client side, potentially leading to Out-Of-Memory (OOM) crashes. - Protocol Violation: The client fails to enforce negotiated connection parameters, trusting the broker implicitly even after constraints have been established.
Read the publisher's advisoryPotential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload in github.com/rabbitmq/amqp091-go
Read the publisher's advisoryCISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
Compare earlier KEV listings and daily EPSS scores. Advisory wording and affected versions have a separate history.
A prediction change is reported when EPSS rises from below 10% to 10% or higher. Other daily score changes remain in this history.
See how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.
Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.
euvd · EUVD-2026-66715 · Published
euvd · EUVD-2026-66715 · Published
euvd · EUVD-2026-66715 · Published
euvd · EUVD-2026-66715 · Published
euvd · EUVD-2026-66715 · Published
euvd · EUVD-2026-66715 · Published
euvd · EUVD-2026-66715 · Published
euvd · EUVD-2026-66715 · Published
euvd · EUVD-2026-66715 · Published
euvd · EUVD-2026-66715 · Published
nvd · CVE-2026-79921 · Published
osv · GHSA-6c5v-hqjr-5xxp · Published
osv · GO-2026-6372 · Published
cve-program · CVE-2026-79921 · Published