Intel

CVE-2026-77403

github.com/rabbitmq/amqp091-go: Allocation of Resources Without Limits or Throttling (CVE-2026-77403)

highEPSS 0.5%

Description

A flaw was found in RabbitMQ amqp091-go, a Go AMQP 0.9.1 client. A malicious or compromised AMQP broker can exploit this by advertising an extremely small frame size during connection negotiation. This can lead to excessive fragmentation of client publications, consuming significant CPU resources and potentially causing a Denial of Service (DoS) by stalling the client or its host.

Source: redhat_csafOSV (Open Source Vulnerabilities)NVD (NIST)GitHub Security Advisoriescvelistv5

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

gogithub.com/rabbitmq/amqp091-go

Metrics

XIEM Effective CVSS
8.9
Source: cna-v4
EPSS percentile
42.7 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
KEV status
—
Show all metrics
Severity
high
Priority score
89.06
Exploit maturity
no public PoC known
CVSS v4
8.9
EPSS score
0.5 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-10-01 20:23 UTC
CWE
CWE-770

Weakness classes (CWE)

  • CWE-770Base

    Allocation of Resources Without Limits or Throttling

    The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-09-16 16:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-77403","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
  2. New CVE Received2026-09-16 15:17 UTC· security-advisories@github.com
    • Description: RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP broker can therefore advertise an extremely small FrameMax, causing later client publications to be fragmented into excessive numbers of frames and write operations. This can consume CPU and stall the client or its host. This issue is fixed in version 1.13.0.
    • CVSS V4.0: AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    • CWE: CWE-770
    • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/77xxx/CVE-2026-77403.json">CVE-2026-77403</a>