CVE-2026-79921: rabbitmq amqp091-go
CVSS: 8.9v4.0HighDeferred
AliasesRHSA-2026:60854UBUNTU-CVE-2026-79921DEBIAN-CVE-2026-79921CGA-2jxm-6mmr-gghqCGA-2m39-cvcq-c4mwCGA-2wv5-74c6-hqqcCGA-3f3x-qg9r-3m9jCGA-3fq4-rj83-qvfhCGA-5hj4-mmww-8h46CGA-5m5m-vh7g-gjvcCGA-627w-x25w-v9w9CGA-7pm2-23vq-2jjvCGA-7r35-4j25-8gpmCGA-84pv-rph4-7h4hCGA-8975-6v4r-crc5CGA-8p64-p59f-fwx6CGA-95f5-86gw-pq6cCGA-cpp9-rwg4-rmx7CGA-cvg6-c5c7-v63pCGA-g28f-m4v5-9q9xCGA-gf4p-22xr-3qj3CGA-gfgx-6j52-cghfCGA-gg5v-m3wf-9x6wCGA-gwcw-746r-vpmjCGA-hmg7-hh9x-v7c7CGA-hr32-q6vp-87gvCGA-j6ch-64h3-wqxfCGA-p5rj-8vf6-8qp8CGA-pcx4-9h49-m3f9CGA-pqg6-r3q9-25h9CGA-q6wf-599j-cm46CGA-r39c-xmc5-8wq8CGA-rh5f-28cx-56g9CGA-rhh7-9xgr-cg9vCGA-rphh-c4gw-p24cCGA-w6rr-wcc6-pmx3GHSA-6c5v-hqjr-5xxpGO-2026-6372CGA-2676-m5j7-xhg4CGA-26rh-2r79-5vg9CGA-37j9-76vv-qhg4CGA-3w3h-p8wj-jm4rCGA-4428-pgpj-7mm3CGA-46m6-r2cg-8gg5CGA-4hh5-pgm5-mm95CGA-57cx-q8jm-p5p3CGA-59qq-xf36-7v7gCGA-5hfr-p96p-92wpCGA-6v2p-3p59-pc2vCGA-6w77-xmgx-7m87CGA-7cj2-mh5x-j562CGA-7gq5-cm4m-p3xxCGA-7x45-7j6p-9c97CGA-88r3-5qcp-26hmCGA-89qv-xhq4-2pgvCGA-9fw7-f77r-4qv5CGA-9vpf-m7jr-5fpqCGA-cxrh-jhfj-fj2wCGA-fqvv-g9jp-g8jcCGA-gv6j-p968-9h6vCGA-h2r9-9x6p-xj4pCGA-hqqv-9rg6-3q75CGA-hwfj-8f89-634xCGA-j29x-f23p-hjc3CGA-j8mc-qgcg-9rmxCGA-m6hq-q2xg-xvfjCGA-mmvm-wff6-pj95CGA-ppgh-p5jx-ww5rCGA-q33j-qq7q-4x55CGA-r4h7-rq6p-rw57CGA-r5jq-h882-cxf6CGA-r999-7wq5-7cj4CGA-rg2q-2jf2-394gCGA-rr3r-2hv9-63wwCGA-rxhj-qjc7-7mwqCGA-v8wq-24cf-qc3cCGA-v97v-6h2m-9434CGA-vf3r-fwq2-29rwCGA-vhm6-fjjv-xc33CGA-wjq2-mpmp-7p9fCGA-x8qx-67x8-94r8CGA-xq32-w88c-3jx9
Published 26-08-2026Last modified 29-08-2026
Vulnerability summary
CVE-2026-79921 is a high (CVSS 8.9) vulnerability in rabbitmq amqp091-go. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.8% of scored vulnerabilities.
CVSS score
8.9/10
010
High · v4.0 (CVE.org)EPSS score
0.55%
0%100%
Low · +0.23 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 26-08-2026PublishedVulnerability first disclosed.
- 29-08-2026Last modifiedVulnerability information updated.
Description
amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.
CVSS metrics
8 scores · 8 sources · 2 versionsHigh 8.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:HSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated8.9HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- OSV · DebianEcosystem advisory · calculated8.9HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated8.9HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- OSV · GoEcosystem advisory · calculated8.9HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- OSV · ChainguardEcosystem advisory · calculated8.9HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- NVDNIST8.9HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High 7.5Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesSingle source
EPSS trend
Probability
0.55%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
+0.23 pp
From 0.32% on 19-09-2026
19-09-202619-10-2026
EPSS score0.55%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard41 products
- argo-events< 1.9.11-r9
- argo-events-fips< 1.9.11-r9
- bento< 1.21.1-r4
- bento-fips< 1.21.1-r5
- dapr-daprd-1.15< 1.15.14-r15 | < 1.15.14-r16
Wolfi18 products
- argo-events< 1.9.11-r9
- bento< 1.21.1-r4
- dapr-daprd-1.16< 1.16.19-r7
- dapr-daprd-1.17< 1.17.13-r5
- falcosidekick< 2.35.0-r3
Debian1 product
- golang-github-rabbitmq-amqp091-goAll versions (No fix recorded) | < 1.14.0-1
Github.com/rabbitmq1 product
- amqp091-go< 1.13.0
Rabbitmq1 product
- amqp091-go< 1.13.0
Redhat1 product
- opentelemetry-collector-contrib< 0:0.159.0-0.1.1.hum1
Ubuntu1 product
- golang-github-rabbitmq-amqp091-goAll versions (No fix recorded)
7 vendors · 64 products
References
16 links- github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxpX Refsource CONFIRMARTICLEREPORTAdvisoryWEB
- github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0X Refsource MISCARTICLEFIXWEB
- images.redhat.comARTICLE
