# github.com/rabbitmq/amqp091-go (Go) vulnerabilities 11 known vulnerabilities (3 critical, 7 high, 1 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.16.0 (Oct 19, 2026): no advisory affects it - Newest unaffected release: v1.16.0 (Oct 19, 2026), the latest release - Releases: 24 since v1.1.0 (Sep 21, 2021) - Registry: https://pkg.go.dev/github.com/rabbitmq/amqp091-go - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-107386: v1.1.0 to v1.13.0 (v1.14.0 is outside it) - CVE-2026-77411: v1.1.0 to v1.12.0 (v1.13.0 is outside it) - CVE-2026-77412: v1.1.0 to v1.12.0 (v1.13.0 is outside it) - CVE-2026-77405: v1.1.0 to v1.12.0 (v1.13.0 is outside it) - CVE-2026-77404: v1.1.0 to v1.12.0 (v1.13.0 is outside it) - CVE-2026-77410: v1.1.0 to v1.12.0 (v1.13.0 is outside it) - CVE-2026-77406: v1.1.0 to v1.12.0 (v1.13.0 is outside it) - CVE-2026-77403: v1.1.0 to v1.12.0 (v1.13.0 is outside it) - CVE-2026-77407: v1.1.0 to v1.12.0 (v1.13.0 is outside it) - CVE-2026-77408: v1.1.0 to v1.12.0 (v1.13.0 is outside it) - CVE-2026-79921: v1.1.0 to v1.12.0 (v1.13.0 is outside it) ## Advisories (11) ### [CVE-2026-107386](https://cve.now/CVE-2026-107386): amqp091-go: Pre-negotiation frame limit is not enforced to 4KB - Severity: Medium 6.3 - Published: Oct 8, 2026 - Affected: fixed in 1.14.0. - Fixed in v1.14.0 (released Aug 18, 2026, 51 days before disclosure). - The latest release, v1.16.0, is not affected. ### [CVE-2026-77411](https://cve.now/CVE-2026-77411): RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr - Severity: Critical 9.5 - Published: Sep 16, 2026 - Affected: fixed in 1.13.0. - Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure). - The latest release, v1.16.0, is not affected. ### [CVE-2026-77412](https://cve.now/CVE-2026-77412): RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client - Severity: High 8.9 - Published: Sep 16, 2026 - Affected: fixed in 1.13.0. - Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure). - The latest release, v1.16.0, is not affected. ### [CVE-2026-77405](https://cve.now/CVE-2026-77405): RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser - Severity: Critical 9.4 - Published: Sep 16, 2026 - Affected: fixed in 1.13.0. - Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure). - The latest release, v1.16.0, is not affected. ### [CVE-2026-77404](https://cve.now/CVE-2026-77404): RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection - Severity: High 8.7 - Published: Sep 16, 2026 - Affected: fixed in 1.13.0. - Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure). - The latest release, v1.16.0, is not affected. ### [CVE-2026-77410](https://cve.now/CVE-2026-77410): RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation - Severity: High 8.9 - Published: Sep 16, 2026 - Affected: fixed in 1.13.0. - Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure). - The latest release, v1.16.0, is not affected. ### [CVE-2026-77406](https://cve.now/CVE-2026-77406): RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration - Severity: High 8.2 - Published: Sep 16, 2026 - Affected: fixed in 1.13.0. - Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure). - The latest release, v1.16.0, is not affected. ### [CVE-2026-77403](https://cve.now/CVE-2026-77403): RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation - Severity: High 8.9 - Published: Sep 16, 2026 - Affected: fixed in 1.13.0. - Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure). - The latest release, v1.16.0, is not affected. ### [CVE-2026-77407](https://cve.now/CVE-2026-77407): RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields - Severity: High 7.0 - Published: Sep 16, 2026 - Affected: fixed in 1.13.0. - Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure). - The latest release, v1.16.0, is not affected. ### [CVE-2026-77408](https://cve.now/CVE-2026-77408): RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow - Severity: Critical 9.1 - Published: Sep 16, 2026 - Affected: fixed in 1.13.0. - Fixed in v1.13.0 (released Jul 21, 2026, 57 days before disclosure). - The latest release, v1.16.0, is not affected. ### [CVE-2026-79921](https://cve.now/CVE-2026-79921): amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload - Severity: High 8.9 - Published: Aug 26, 2026 - Affected: fixed in 1.13.0. - Fixed in v1.13.0 (released Jul 21, 2026, 36 days before disclosure). - The latest release, v1.16.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/rabbitmq/amqp091-go Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.