Advisories for Golang/Github.com/Rabbitmq/Amqp091-Go package

2026

RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow

A data integrity and protocol corruption vulnerability exists in the AMQP client's property serialization logic. When encoding AMQP short string (shortstr) fields—such as identifiers, routing strings, and content metadata—the length of the string is explicitly cast to a fixed-size 8-bit unsigned integer (uint8). If an application provides a property string exceeding 255 bytes, the length counter silently wraps around (e.g., a length of 300 wraps to 44). As a result, …

RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation

Summary A flaw in the recvContent function allows a malicious AMQP server to trigger an Out-of-Memory (OOM) error, forcing the host operating system or container runtime to immediately terminate the client process. Vulnerability Details When receiving message content payloads, the client processes the expected size from the content header framework. The recvContent function attempts to optimize performance by pre-allocating memory for the message body based on the ch.header.Size field, which …

RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr

Summary A critical stream desynchronization vulnerability has been identified in the AMQP wire-protocol parser. When parsing a long string (readLongstr) within a table field, providing a length that exceeds the maximum signed 32-bit integer (2^31 - 1, or roughly 2.1 GiB) triggers an improper error-handling condition. The parser abruptly aborts the read and returns a success status ("",nil) without consuming the specified bytes from the underlying network buffer. This causes …

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

An information disclosure vulnerability exists in the AMQP client implementation's authentication handling configuration. Following a successful connection handshake, the Connection.Config.SASL field stores the Authentication implementation state used to establish the session. For standard PLAIN authentication, this state utilizes the PlainAuth struct, which defines both Username and Password as publicly exported, plaintext string fields. Because this sensitive data is retained permanently in-memory within an exported field structure, any peripheral code, internal …

RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser

A structural security weakness exists in the AMQP client's TLS configuration generator (tlsConfigFromURI). When constructing a *tls.Config object from an amqps:// connection URI, the library initializes the structure without explicitly defining the MinVersion field. While modern versions of the Go compiler toolchain (Go 1.18+) default the implicit minimum version to TLS 1.2, this security posture relies entirely on an implicit toolchain dependency. If the library is compiled using legacy Go …

RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation

A Denial of Service (DoS) vulnerability exists in the AMQP client's connection negotiation logic. The AMQP specification explicitly mandates a strict minimum frame size of 4096 bytes to prevent pathological packet fragmentation. While the library defines a frameMinSize = 4096 constant, the connection negotiation loop fails to enforce this boundary, blindly accepting whatever maximum frame size (FrameMax) the server advertises during the handshake. If a client connects to a malicious …

RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client

Summary A vulnerability in the readField function allows a malicious or compromised AMQP server to trigger an unhandled runtime panic in the client application, leading to an immediate crash of the entire process. Details When parsing incoming AMQP frames, the readField function processes byte-array fields (type tag 'x') by reading a 32-bit big-endian integer to determine the length of the data payload. // read.go:253-263 case 'x': var len int32 if …

RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration

A logic and resource exhaustion vulnerability exists in the AMQP client's Quality of Service (Qos) configuration method. The Qos function accepts signed integers (int) for the prefetchCount and prefetchSize parameters but casts them directly to unsigned integers (uint16 and uint32, respectively) when formatting the wire-level frame. If a developer passes a negative integer (such as -1) to these parameters—frequently intended as a sentinel value meaning "no change" or "no limit"—the …

RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

A query parameter injection vulnerability exists in the AMQP client's connection URI formatting logic. When generating or parsing connection URIs, TLS-related filesystem paths (such as certificates or keys) are appended directly to the URI's query string using string concatenation rather than secure URL encoding via functions like url.QueryEscape. If an application handles a TLS file path containing special character delimiters (such as & or =), these characters are interpreted as …

amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

Summary A vulnerability exists in the amqp091-go client library where a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Details During a standard AMQP 0-9-1 connection handshake, the client and the broker negotiate a maximum …