The RabbitMQ amqp091-go client is vulnerable to a denial of service attack where a malicious broker forces excessive memory allocation, necessitating an immediate update to version 1.13.0.

This vulnerability, categorized as CWE-770 (Allocation of Resources Without Limits or Throttling), occurs because the client fails to enforce frame_max limits when processing content body frames from a broker. This allows an unauthenticated, remote attacker operating a malicious or compromised broker to cause significant memory consumption and application crashes.

Successful exploitation of this flaw can lead to a complete denial of service for any application relying on the amqp091-go client. Given the CVSS score of 8.9, this represents a high-severity risk to business continuity, as critical messaging infrastructure could be rendered unavailable by a malicious broker, leading to system downtime and loss of service availability.

Immediate Action: Upgrade the amqp091-go library to version 1.13.0 or later to ensure proper enforcement of protocol framing constraints.

Proactive Monitoring: Monitor application logs and system memory metrics for unusual spikes in resource consumption or sudden service restarts that may indicate an attempt to trigger this vulnerability.

Compensating Controls: Ensure that AMQP brokers are trusted and properly secured, as this vulnerability relies on the interaction with a malicious or compromised broker instance.

Public Exploit Available: Unknown.

This vulnerability presents a significant risk to the stability of messaging-dependent systems. Administrators should prioritize the update to version 1.13.0 across all environments. If an immediate update is not feasible, restrict client connectivity to trusted, verified broker instances to mitigate the risk of exploitation.