CVE-2026-107386 rabbitmq CVE debrief

Who should care

Defenders responsible for Go client deployments using the amqp091-go package should assess exposure and prioritize verification and remediation. Defenders should prioritize verifying and updating to version 1.14.0 or later of the amqp091-go package to mitigate this vulnerability, as it can cause excessive memory allocation and potentially terminate the Go client process through memory exhaustion before authentication and connection setup complete.

Why it matters

Defenders should prioritize verifying and updating to version 1.14.0 or later of the amqp091-go package to mitigate this vulnerability, as it can cause excessive memory allocation and potentially terminate the Go client process through memory exhaustion before authentication and connection setup complete.

• Potential memory exhaustion leading to Go client process termination
• Bypass of pre-negotiation frame limit before authentication and connection setup complete
• Excessive memory allocation due to malicious or compromised AMQP peer
• Verification priority for affected deployments and remediation

Technical summary

The frame-size mitigation released in amqp091-go v1.13.0 can be bypassed before connection.tune completes, allowing a malicious or compromised AMQP peer to send a large attacker-controlled uint32 payload length. The bypass occurs because Connection.maxFrameSize starts at zero, allowing a malicious broker to cause excessive memory allocation, potentially terminating the Go client process through memory exhaustion before authentication and connection setup complete. Defenders should prioritize verifying and updating to version 1.14.0 or later of the amqp091-go package to mitigate this vulnerability.

Defensive priority

Defenders should prioritize verifying and updating to version 1.14.0 or later of the amqp091-go package to mitigate this vulnerability.

Recommended defensive actions

• Verify and update to version 1.14.0 or later of the amqp091-go package
• Implement compensating controls to monitor and limit memory allocation
• Review and adjust connection setup and authentication configurations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The bypass occurs because Connection.maxFrameSize starts at zero, allowing a malicious broker to cause excessive memory allocation, potentially terminating the Go client process through memory exhaustion. The frame-size mitigation released in amqp091-go v1.13.0 can be bypassed before connection.tune completes, allowing a malicious or compromised AMQP peer to send a large attacker-controlled uint32 payload length. Defenders should prioritize verifying and updating to version 1.14.0 or later of the amqp091-go package to mitigate this.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.