In RabbitMQ amqp091-go versions before 1.13.0, the Channel.Qos function in channel.go lacks validation for negative prefetchCount and prefetchSize parameters. These negative values are cast directly to uint16 and uint32 types, causing wrap-around to large unsigned integers (e.g., -1 becomes 65535 or 4294967295). If an application allows untrusted configuration of these QoS values, an attacker could cause the client to request extremely large prefetch limits, leading to excessive memory consumption and potential disruption of message processing. This vulnerability is addressed by adding validation in version 1.13.0.

An attacker who can influence the QoS configuration parameters can cause the client to request very large prefetch counts, resulting in the client receiving an excessive number of queued messages. This can exhaust the client's memory resources and disrupt normal message processing, potentially causing denial of service conditions on the client side.

Upgrade to RabbitMQ amqp091-go version 1.13.0 or later, where this issue is fixed by proper validation of QoS parameters. Until upgrading, avoid allowing untrusted sources to configure prefetchCount and prefetchSize values to prevent exploitation.