CVE-2026-77403

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP broker can therefore advertise an extremely small FrameMax, causing later client publications to be fragmented into excessive numbers of frames and write operations. This can consume CPU and stall the client or its host. This issue is fixed in version 1.13.0.

• CWE-770

• https://github.com/rabbitmq/amqp091-go/commit/2e0a919b89f337dbf58db2bb34ab206dac354a06
• https://github.com/rabbitmq/amqp091-go/pull/353
• https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0
• https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-xwwf-m8fg-p9q2

Published

Sep 16, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77393In Ignition 8.1.53 and earlier, the Gateway "Create Project …8.8
• CVE-2026-77394OpenC3 COSMOS provides the functionality needed to send comm…7.6
• CVE-2026-77396PJSIP is a free and open source multimedia communication lib…6.9
• CVE-2026-77399icalendar is an RFC 5545 compatible parser and generator of …6.5
• CVE-2026-7740A security vulnerability has been detected in justdan96 tsMu…3.3
• CVE-2026-77401Zope AccessControl provides a general security framework for…6.8
• CVE-2026-77404RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.7
• CVE-2026-77405RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…9.4
• CVE-2026-77406RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.2
• CVE-2026-77407RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…7
• CVE-2026-77408RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…9.1
• CVE-2026-77409RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.2