CyberRota Analysis
AI-GeneratedThe RabbitMQ amqp091-go client prior to version 1.13.0 is vulnerable to a protocol negotiation flaw that allows a malicious AMQP broker to advertise a FrameMax below the required minimum, leading to excessive fragmentation of client publications. This can result in significant CPU consumption and potential stalling of the client or its host system. Organizations using this client should prioritize upgrading to version 1.13.0 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP broker can therefore advertise an extremely small FrameMax, causing later client publications to be fragmented into excessive numbers of frames and write operations. This can consume CPU and stall the client or its host. This issue is fixed in version 1.13.0.