A critical resource exhaustion vulnerability in the RabbitMQ amqp091-go client (versions prior to 1.13.0) can be exploited by a malicious broker to cause denial of service on the client application.

This is a resource allocation flaw (CWE-770) where the connection negotiation process fails to enforce the minimum protocol frame size of 4096 bytes. This allows an unauthenticated attacker, acting as a malicious AMQP broker, to force the client into excessive frame fragmentation and CPU-intensive write operations.

The vulnerability carries a CVSS score of 8.9, reflecting a high risk of service unavailability. Successful exploitation could lead to significant operational downtime for applications relying on this library, potentially impacting upstream services and business continuity. The ability for a compromised or malicious broker to stall client hosts creates a severe reliability risk for distributed systems.

Immediate Action: Update the amqp091-go library to version 1.13.0 or later to ensure the connection negotiation loop correctly enforces the 4096-byte frame minimum.

Proactive Monitoring: Monitor application resource metrics, specifically identifying spikes in CPU utilization or abnormal thread counts occurring during AMQP connection establishment.

Compensating Controls: Ensure that AMQP brokers are trusted and configured within a secure, isolated network perimeter to prevent unauthorized entities from acting as a message broker.

Public Exploit Available: No

Given the high CVSS score and the potential for a complete denial of service, organizations should prioritize updating their RabbitMQ amqp091-go dependencies. While the attack vector requires a malicious or compromised broker, the impact on system stability is severe, and applying the vendor-provided patch in version 1.13.0 is the only effective way to remediate this vulnerability.