Skip to content
Fencer Intel
high 8.9

CVE-2026-79921 json

amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

published 2mo ago modified last mo. also GHSA-6c5v-hqjr-5xxp , GO-2026-6372 , EUVD-2026-66715

cvss
8.9
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 46%
public exploits
0
none known

Summary

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.

Patch / fix

  • go github.com/rabbitmq/amqp091-go 1.13.0
  • golang-github-rabbitmq-amqp091-go Debian 14 1.14.0-1

debian advisories DEBIAN-CVE-2026-79921

  • opentelemetry-collector-contrib hummingbird 1 0.162.0-0.2.hum1
  • opentelemetry-collector-contrib hummingbird 1 0.159.0-0.1.1.hum1

red hat advisories RHSA-2026:80217RHSA-2026:60854

  • govulncheck-vulndb SLES 16.0, SLES for SAP applications 16.0 0.0.20260916T180043-160000.1.1

suse advisories SUSE-SU-2026:23855-1SUSE-SU-2026:23863-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260916T180043-160000.1.1

opensuse advisories openSUSE-SU-2026:21897-1

  • keda Azure Linux 3.0 2.14.1-18
  • telegraf Azure Linux 3.0 1.31.0-31

azure linux advisories AZL-98201AZL-98214

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-79921 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-79921 updated cvss 7.5

github.com/rabbitmq/amqp091-go: amqp091-go: Denial of Service via oversized AMQP payloads

  • Red Hat OpenShift Serverless openshift-serverless-1/kn-plugin-event-sender-rhel9 Red Hat Quay 3 quay/clair-rhel8, quay/clair-rhel9
    affected: workaround, no fix available
  • Red Hat Custom Metric Autoscaler 2.19 custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 1788361799, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 1788361753, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator 1788290121, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle 1788363289, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 1788361758, custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9 1788290333, +2 more
    fixed: vendor fix RHSA-2026:62866
  • Red Hat Multicluster Global Hub 1.7.4 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1788376193
    fixed: vendor fix RHSA-2026:67842
  • Red Hat Multicluster Global Hub 1.8.2 multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1788441983, multicluster-globalhub/multicluster-globalhub-grafana-rhel9 1790639009
    fixed: vendor fix RHSA-2026:68515
  • Red Hat Hardened Images opentelemetry-collector-contrib 0.162.0-0.2.hum1, opentelemetry-collector-contrib 0.159.0-0.1.1.hum1
    fixed: vendor fix RHSA-2026:60854
  • Red Hat Quay 3.9 quay/quay-rhel8 1790808443
    fixed: vendor fix RHSA-2026:77656
  • Red Hat Quay 3.10 quay/quay-rhel8 1791462428
    fixed: vendor fix RHSA-2026:79366
  • Red Hat Quay 3.12 quay/quay-rhel8 1791314514
    fixed: vendor fix RHSA-2026:79546
show 2 more
  • Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9
    not affected: component not present
  • Red Hat Multicluster Global Hub 1.7.4 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1788377473, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1788377424, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1788372439, multicluster-globalhub/multicluster-globalhub-operator-bundle 1788503575, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9 1788200952 Red Hat Multicluster Global Hub 1.8.2 multicluster-globalhub/multicluster-globalhub-agent-rhel9 1788359470, multicluster-globalhub/multicluster-globalhub-agent-rhel9 1790638612, multicluster-globalhub/multicluster-globalhub-manager-rhel9 1788359454, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1788359461, multicluster-globalhub/multicluster-globalhub-rhel9-operator 1790638386, multicluster-globalhub/multicluster-globalhub-operator-bundle 1788496240, +3 more Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/volsync-rhel9, rhacm2/acm-grafana-rhel9, rhacm2/volsync-operator-bundle Red Hat OpenStack Platform 18.0 rhoso-operators/rabbitmq-cluster-rhel9-operator Red Hat Quay 3.9 quay/clair-rhel8 1790697042, quay/quay-builder-rhel8 1790400755, quay/quay-operator-rhel8 1790399891, quay/quay-operator-bundle 1790903947, quay/quay-bridge-operator-rhel8 1790399899, quay/quay-bridge-operator-bundle 1790400430, +3 more Red Hat Quay 3.10 quay/clair-rhel8 1791318071, quay/quay-builder-rhel8 1791218455, quay/quay-operator-rhel8 1790399749, quay/quay-operator-bundle 1791465969, quay/quay-bridge-operator-rhel8 1790400341, quay/quay-bridge-operator-bundle 1790401388, +3 more
    +1 more products
    Red Hat Quay 3.12 quay/clair-rhel8 1791318122, quay/quay-builder-rhel8 1791314224, quay/quay-operator-rhel8 1791435060, quay/quay-operator-bundle 1791436613, quay/quay-bridge-operator-rhel8 1791390151, quay/quay-bridge-operator-bundle 1791390652, +3 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2mo ago

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 4.0 8.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
CNA 4.0 8.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
go github.com/rabbitmq/amqp091-go
<1.13.0
1.13.0

Affected products

  • rabbitmq amqp091-go

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.