The RabbitMQ amqp091-go client is vulnerable to a memory exhaustion attack that can cause service denial by terminating the client process.

The vulnerability exists in the Channel.recvContent function, which fails to cap memory allocation based on the negotiated frame size. An unauthenticated attacker acting as a malicious broker can trigger an out of memory error in the Go runtime, resulting in a crash of the client application.

This flaw poses a significant risk to the availability of systems relying on the amqp091-go client for message queuing. Successful exploitation results in a denial of service for the impacted application, potentially disrupting critical business workflows or data pipelines. With a CVSS score of 8.9, this high severity vulnerability necessitates immediate attention to prevent operational downtime.

Immediate Action: Update the amqp091-go library to version 1.13.0 or later to implement proper memory allocation limits.

Proactive Monitoring: Monitor application logs for sudden process terminations or Go runtime memory pressure warnings.

Compensating Controls: Ensure that client connections are restricted to trusted, authenticated brokers to mitigate the risk of interaction with malicious entities.

Public Exploit Available: No

Given the potential for service disruption, administrators should prioritize updating the amqp091-go dependency across all affected environments. Implementing the patch provided in version 1.13.0 is the only effective way to prevent this memory exhaustion vulnerability from impacting production services.