amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer can send a short body-frame header with a large declared payload length, causing ReadFrame and the body-frame parser to allocate attacker-selected memory before the payload is received or the frame's protocol state is rejected. The condition is reachable through public Open even when Config.FrameSize is set to the protocol minimum and can cause severe memory pressure, out-of-memory termination, or loss of the client process before authentication completes. This issue is fixed in version 1.14.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior
    allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses
    zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer
    can send a short body-frame header with a large declared payload length, causing ReadFrame and the body-
    frame parser to allocate attacker-selected memory before the payload is received or the frame's protocol
    state is rejected. The condition is reachable through public Open even when Config.FrameSize is set to the
    protocol minimum and can cause severe memory pressure, out-of-memory termination, or loss of the client
    process before authentication completes. This issue is fixed in version 1.14.0. (CVE-2026-107386)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior     allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses     zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer     can send a short body-frame header with a large declared payload length, causing ReadFrame and the body-     frame parser to allocate attacker-selected memory before the payload is received or the frame's protocol     state is rejected. The condition is reachable through public Open even when Config.FrameSize is set to the     protocol minimum and can cause severe memory pressure, out-of-memory termination, or loss of the client     process before authentication completes. This issue is fixed in version 1.14.0. (CVE-2026-107386)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474124	Echo: github.com/rabbitmq/amqp091-go: security update to 1.14.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
474124	Echo: github.com/rabbitmq/amqp091-go: security update to 1.14.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
473986	SCA: security update for github.com/rabbitmq/amqp091-go (GHSA-w6r9-248c-frg8)	Tenable Cloud Security	SCA Checks	Local	medium
473986	SCA: security update for github.com/rabbitmq/amqp091-go (GHSA-w6r9-248c-frg8)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
364394	Linux Distros Unpatched Vulnerability : CVE-2026-107386	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-107386

medium

Tenable Plugins

medium

medium

medium

medium

medium