RabbitMQ amqp091-go versions before 1.13.0 do not enforce the AMQP protocol minimum frame size (4096 bytes) during connection negotiation. Specifically, Connection.openTune in connection.go accepts a FrameMax value from the server that can be smaller than this minimum. A malicious or compromised AMQP broker can exploit this by advertising a very small FrameMax, resulting in client messages being fragmented into excessive frames and write operations. This resource exhaustion can cause high CPU usage and stall the client or its host system. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). It is fixed in version 1.13.0.

An attacker controlling or compromising the AMQP broker can cause the client to consume excessive CPU resources by forcing it to fragment messages into many small frames. This can stall the client application or the host system, leading to denial of service conditions. There is no indication of direct data compromise or privilege escalation from this vulnerability.

Upgrade the RabbitMQ amqp091-go client to version 1.13.0 or later, where this issue is fixed. The fix enforces the protocol minimum FrameMax size during connection negotiation, preventing maliciously small frame sizes from being accepted. No other mitigations are indicated.