amqp091-go Library Vulnerability: Memory Exhaustion Risk
- Severity
- HIGH
- Affected component
- amqp091-go (go)
- Affected versions
- < 1.13.0
- Patched version
- Not yet available
An early warning has been issued regarding a vulnerability in the amqp091-go client library. This issue may allow a compromised or malicious AMQP broker to force the client to process oversized payloads, potentially leading to memory exhaustion or denial of service.
What happened
An early warning has been issued for a vulnerability in the amqp091-go client library. This vulnerability reportedly allows a compromised or malicious AMQP broker to force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints.
The vulnerability affects versions of amqp091-go prior to 1.13.0. The issue is under investigation and no official fix has been published yet. Users of this library should monitor updates from the maintainers and consider using an alternative AMQP client library until a fix is released.
What to do about it
- Monitor for updates from the maintainers of the amqp091-go library.
- Consider using a different AMQP client library until a fix is released.
- Review your application's memory management practices to mitigate potential DoS impacts.
- Stay informed by consulting the primary sources for the latest information on this vulnerability.
How 0Day would have caught this
amqp091-go is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You may be affected if you are using the amqp091-go client library in versions prior to 1.13.0.
What should I do right now?
Monitor for updates from the maintainers of the amqp091-go library and consider using a different AMQP client library until a fix is released.
Is there an official fix available?
No official fix has been published yet. Continue to monitor the primary sources for updates.