- Latest release
- v1.16.0 (Oct 19, 2026): no advisory affects it
- Newest unaffected release
- v1.16.0 (Oct 19, 2026), the latest release
- Advisories
- 11 · 3 critical, 7 high, 1 medium
- Releases
- 24 since v1.1.0 (Sep 21, 2021)
- Registry
- pkg.go.dev
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-107386Affects v1.1.0 to v1.13.0 (v1.14.0 is outside it)
- CVE-2026-77411Affects v1.1.0 to v1.12.0 (v1.13.0 is outside it)
- CVE-2026-77412Affects v1.1.0 to v1.12.0 (v1.13.0 is outside it)
- CVE-2026-77405Affects v1.1.0 to v1.12.0 (v1.13.0 is outside it)
- CVE-2026-77404Affects v1.1.0 to v1.12.0 (v1.13.0 is outside it)
- CVE-2026-77410Affects v1.1.0 to v1.12.0 (v1.13.0 is outside it)
- CVE-2026-77406Affects v1.1.0 to v1.12.0 (v1.13.0 is outside it)
- CVE-2026-77403Affects v1.1.0 to v1.12.0 (v1.13.0 is outside it)
- CVE-2026-77407Affects v1.1.0 to v1.12.0 (v1.13.0 is outside it)
- CVE-2026-77408Affects v1.1.0 to v1.12.0 (v1.13.0 is outside it)
- CVE-2026-79921Affects v1.1.0 to v1.12.0 (v1.13.0 is outside it)
Advisories 11
- CVE-2026-107386Medium 6.3
amqp091-go: Pre-negotiation frame limit is not enforced to 4KB
Affected: fixed in 1.14.0.
Fixed in v1.14.0 (released Aug 18, 2026, 51 days before disclosure).
The latest release, v1.16.0, is not affected.
- CVE-2026-77411Critical 9.5
RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr
Affected: fixed in 1.13.0.
Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure).
The latest release, v1.16.0, is not affected.
- CVE-2026-77412High 8.9
RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client
Affected: fixed in 1.13.0.
Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure).
The latest release, v1.16.0, is not affected.
- CVE-2026-77405Critical 9.4
RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser
Affected: fixed in 1.13.0.
Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure).
The latest release, v1.16.0, is not affected.
- CVE-2026-77404High 8.7
RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection
Affected: fixed in 1.13.0.
Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure).
The latest release, v1.16.0, is not affected.
- CVE-2026-77410High 8.9
RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation
Affected: fixed in 1.13.0.
Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure).
The latest release, v1.16.0, is not affected.
- CVE-2026-77406High 8.2
RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration
Affected: fixed in 1.13.0.
Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure).
The latest release, v1.16.0, is not affected.
- CVE-2026-77403High 8.9
RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation
Affected: fixed in 1.13.0.
Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure).
The latest release, v1.16.0, is not affected.
- CVE-2026-77407High 7.0
RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields
Affected: fixed in 1.13.0.
Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure).
The latest release, v1.16.0, is not affected.
- CVE-2026-77408Critical 9.1
RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow
Affected: fixed in 1.13.0.
Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure).
The latest release, v1.16.0, is not affected.
- CVE-2026-79921High 8.9
amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
Affected: fixed in 1.13.0.
Fixed in v1.13.0 (released Jul 21, 2026, 36 days before disclosure).
The latest release, v1.16.0, is not affected.