GO-2026-6700 Pre-negotiation frame limit is not enforced to 4KB in github.com/rabbitmq/amqp091-go

Pre-negotiation frame limit is not enforced to 4KB in github.com/rabbitmq/amqp091-go...

PT-2026-118022

Pre-negotiation frame limit is not enforced to 4KB in github.com/rabbitmq/amqp091-go...

GHSA-W6R9-248C-FRG8 amqp091-go: Pre-negotiation frame limit is not enforced to 4KB

Summary The frame-size mitigation released in amqp091-go v1.13.0 can be bypassed before connection.tune completes. A malicious or compromised AMQP peer can send only a seven-byte body-frame header containing a large attacker-controlled uint32 payload length. The client allocates a slice of that...

amqp091-go: Pre-negotiation frame limit is not enforced to 4KB

Summary The frame-size mitigation released in amqp091-go v1.13.0 can be bypassed before connection.tune completes. A malicious or compromised AMQP peer can send only a seven-byte body-frame header containing a large attacker-controlled uint32 payload length. The client allocates a slice of that...