amqp091-go Library Vulnerability: Memory Exhaustion Risk
- Severity
- HIGH
- Affected component
- amqp091-go (go)
- Affected versions
- < 1.13.0
- Patched version
- Not yet available
An early warning has been issued regarding a vulnerability in the amqp091-go client library that could lead to memory exhaustion or denial of service. Users of versions prior to 1.13.0 are potentially affected.
What happened
A vulnerability has been reported in the amqp091-go client library where a compromised or malicious AMQP broker can force the client to process oversized content body frames. This can result in unexpected memory consumption or application-layer denial of service (DoS), effectively bypassing the protocol's framing constraints. The vulnerability is under investigation and has not been exploited in the wild as of the latest reports.
The affected component is the amqp091-go library for Go, specifically versions prior to 1.13.0. This vulnerability allows a malicious broker to send frames larger than the negotiated frame_max limit, leading to potential memory exhaustion on the client side.
What to do about it
- Monitor for updates from the maintainers of the amqp091-go library.
- Consider upgrading to version 1.13.0 or later if possible to mitigate the risk.
- If upgrading is not feasible, consider using alternative AMQP libraries as a temporary measure.
- Implement additional monitoring for unusual memory consumption patterns in applications using the amqp091-go library.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
amqp091-go is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are potentially affected if you are using the amqp091-go library in versions prior to 1.13.0.
What should I do right now?
Monitor for updates from the maintainers and consider upgrading to version 1.13.0 or later. If upgrading is not possible, consider using alternative libraries.
Is there an official patch available?
No official patch has been published yet. Continue to monitor the sources for updates.