Source: golang-github-rabbitmq-amqp091-go Version: 1.12.0-1 Severity: important Tags: security upstream Forwarded: https://github.com/rabbitmq/amqp091-go/pull/353 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for golang-github-rabbitmq-amqp091-go. CVE-2026-79921[0]: | amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a | compromised or malicious AMQP broker can force the client to | allocate resources for and process content body frames that exceed | the negotiated frame_max limit. This can lead to unexpected memory | consumption or application-layer denial of service (DoS), bypassing | the protocol's built-in framing constraints. Version 1.13.0 contains | a fix. No known workarounds are available. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-79921 https://www.cve.org/CVERecord?id=CVE-2026-79921 [1] https://github.com/rabbitmq/amqp091-go/pull/353 [2] https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp [3] https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
