CVE-2026-79921: CWE-770: Allocation of Resources Without Limits or Throttling in rabbitmq amqp091-go

The amqp091-go client library fails to enforce the negotiated maximum frame size (frame_max) during AMQP 0-9-1 connections. After negotiation, a malicious broker can send a content body frame with a declared payload size exceeding frame_max. Instead of rejecting this frame and closing the connection as per the AMQP specification, the client accepts the oversized frame, allocates memory accordingly, and processes the payload. This behavior can cause unexpected memory consumption and application-layer denial of service.

This vulnerability allows a malicious or compromised AMQP broker to cause the client to allocate excessive memory, potentially leading to out-of-memory crashes and denial of service. It also represents a protocol violation since the client does not enforce the negotiated frame size limits, trusting the broker beyond the agreed constraints.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious when connecting to untrusted AMQP brokers and consider additional network-level protections to limit exposure.