UBUNTU-CVE-2026-79921

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-79921

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-79921.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-79921

Upstream

CVE-2026-79921

Published

2026-08-26T21:16:00Z

Modified

2026-09-02T19:36:34Z

Severity

8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.

References

Affected packages

Ubuntu:24.04:LTS / golang-github-rabbitmq-amqp091-go

Package

Name: golang-github-rabbitmq-amqp091-go
Purl: pkg:deb/ubuntu/golang-github-rabbitmq-amqp091-go?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.8.1-2

1.9.0-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "golang-github-rabbitmq-amqp091-go-dev",
            "binary_version": "1.9.0-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-79921.json"

Ubuntu:26.04:LTS / golang-github-rabbitmq-amqp091-go