CVE-2026-77410

Channel.recvContent in channel.go of the RabbitMQ amqp091-go Go client preallocates the message body slice using the uint64 size declared in an AMQP content header, without capping the allocation to the negotiated Connection.Config.FrameSize. A malicious or compromised broker can therefore declare an extreme body size, causing the Go runtime to attempt a correspondingly huge allocation before any body data is actually received, and the resulting memory exhaustion can terminate the client process. An attacker who controls or compromises the broker gains denial of service only — there is no confidentiality or integrity impact, though downstream systems relying on the client's availability are also affected (CVSS 4.0 rates availability impact high). Any Go application built with amqp091-go before 1.13.0 that consumes messages from a broker is affected, with real-world exploitability contingent on the broker turning malicious or being compromised. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known.

What to do: Upgrade the github.com/rabbitmq/amqp091-go dependency to version 1.13.0 or later, then verify via go.mod, go list -m all, or govulncheck that no stale copies of older versions remain in the build. Until upgraded, limit consumers to trusted brokers over TLS, treat shared or multi-tenant broker environments as higher risk, and monitor client processes for abnormal memory growth. There is no configuration-only substitute for the fix, since the patched code caps the preallocation to the negotiated frame size.