CyberRota Analysis
AI-GeneratedThe RabbitMQ amqp091-go client prior to version 1.13.0 is vulnerable due to synchronous handling of publisher confirmations and other events, which can lead to connection stalls and deadlocks if the application-provided listener channel is unbuffered or not drained in a timely manner. This vulnerability can severely impact message processing, resulting in missed heartbeats and potential disconnections. Organizations using this client should prioritize upgrading to version 1.13.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.dispatch in channel.go, confirms.confirm in confirms.go, and Connection.dispatch0 in connection.go synchronously send publisher confirmations, flow-control events, consumer cancellations, returned messages, including NotifyConfirm events and connection block notifications, to application-provided channels. If a listener channel is unbuffered, full, or not drained promptly, the sole reader goroutine blocks and stops processing frames, acknowledgments, deliveries, and heartbeats. Broker-driven event bursts can therefore cause connection stalls, missed heartbeats, deadlocks, and disconnection. This issue is fixed in version 1.13.0.