Description
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rabbitmq | amqp091-go | < 1.13.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-rabbitmq-amqp091-go | 1.14.0-1 | — |
| Debian 13 | golang-github-rabbitmq-amqp091-go | No fix yet | — |
| Debian 12 | golang-github-rabbitmq-amqp091-go | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-github-rabbitmq-amqp091-go | No fix yet | — |
| Ubuntu 26.04 LTS | golang-github-rabbitmq-amqp091-go | No fix yet | — |
| Ubuntu 24.04 LTS | golang-github-rabbitmq-amqp091-go | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | opentelemetry-collector-contrib | 0.159.0-0.1.1.hum1 | RHSA-2026:80217, RHSA-2026:60854 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 | SUSE-SU-2026:23863-1, SUSE-SU-2026:23855-1 |
| SLES 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 | SUSE-SU-2026:23863-1, SUSE-SU-2026:23855-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 | openSUSE-SU-2026:21897-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | keda | 2.14.1-18 | — |
| Azure Linux 3 | telegraf | 1.31.0-31 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-events | 1.9.11-r9 | — |
| Wolfi rolling | bento | 1.21.1-r4 | — |
| Wolfi rolling | dapr-daprd-1.17 | 1.17.13-r5 | — |
| Wolfi rolling | falcosidekick | 2.35.0-r3 | — |
| Wolfi rolling | guac +2 | 1.1.0-r33 | — |
| Wolfi rolling | keda-2.19-metrics-apiserver | 2.19.0-r30 | — |
| Wolfi rolling | keda-2.20 +1 | 2.20.2-r7 | — |
| Wolfi rolling | minio | 0.20260717.120751-r14 | — |
| Wolfi rolling | opentelemetry-collector-contrib | 0.160.0-r1 | — |
| Wolfi rolling | sftpgo-plugin-pubsub | 1.0.18-r8 | — |
| Wolfi rolling | telegraf-1.38 | 1.38.4-r27 | — |
| Wolfi rolling | trufflehog | 3.97.4-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/rabbitmq/amqp091-go | < 1.13.0 | 1.13.0 | GHSA-6c5v-hqjr-5xxp |
Advisories 5
- RHSA-2026:80217 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:60854 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- SUSE-SU-2026:23863-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 27, 2026
- SUSE-SU-2026:23855-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 27, 2026
- openSUSE-SU-2026:21897-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Sep 25, 2026