CyberRota Analysis
AI-GeneratedRabbitMQ amqp091-go versions prior to 1.13.0 are vulnerable to a memory exhaustion attack due to improper handling of message body size allocations, which can be exploited by a malicious broker to crash the client process. This vulnerability poses a high risk, particularly for organizations using this Go AMQP client in environments where they interact with untrusted brokers. Users of affected versions should prioritize upgrading to version 1.13.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header.Size value supplied by an AMQP content header without capping the allocation to the negotiated Connection.Config.FrameSize value. A malicious or compromised broker can send an extreme declared body size and cause the Go runtime to attempt a correspondingly large allocation before body data is received. The allocation can exhaust memory and terminate the client process. This issue is fixed in version 1.13.0.