fix(deps): update module github.com/rabbitmq/amqp091-go to v1.13.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/rabbitmq/amqp091-go	v1.9.0 → v1.13.0

---

amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload

CVE-2026-79921 / GHSA-6c5v-hqjr-5xxp

More information

Details

Summary
A vulnerability exists in the amqp091-go client library where a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints.

Details
During a standard AMQP 0-9-1 connection handshake, the client and the broker negotiate a maximum frame size (frame_max), for example, 4096 bytes.

However, after negotiation, a malicious broker can send a valid basic.deliver sequence containing a content body frame whose header declares a payload size larger than the negotiated frame_max. Instead of enforcing the agreed-upon limit and closing the connection with a frame-error (as mandated by the AMQP 0-9-1 specification), the amqp091-go client:

1. Accepts the broker-declared oversized frame size.
2. Allocates memory based on this oversized declaration.
3. Reads the payload, assembles it into the message, and delivers it to the consumer.

Impact

• Denial of Service (DoS): If a broker sends extremely large frame sizes, it can trigger significant memory allocations on the client side, potentially leading to Out-Of-Memory (OOM) crashes.
• Protocol Violation: The client fails to enforce negotiated connection parameters, trusting the broker implicitly even after constraints have been established.

Severity

• CVSS Score: 8.9 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

References

• https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp
• https://nvd.nist.gov/vuln/detail/CVE-2026-79921
• https://github.com/rabbitmq/amqp091-go/pull/353
• https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0
• https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0
• https://github.com/advisories/GHSA-6c5v-hqjr-5xxp

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

rabbitmq/amqp091-go (github.com/rabbitmq/amqp091-go)

v1.13.0

Compare Source

Full Changelog

Implemented enhancements:

• refactor: extract shared close prologue into beginClose() #​376 (suchitd)

Fixed bugs:

• Retry consumer recovery instead of cancelling on a failed re-subscribe #​380 (lukebakken)
• Fix auto-recovery correctness gaps #​379 (suchitd)
• Enforce frame size in pre-negotiation state #​377 (Zerpet)
• test: retry cleanup connection after clearing memory alarm #​375 (suchitd)
• fix: eliminate flakiness in TestTLSHandshake #​373 (suchitd)
• fix: close goroutine leaks from Close()/Reconnect() races #​372 (suchitd)

Merged pull requests:

• chore(deps): reduce github-actions dependabot updates to weekly #​384 (suchitd)
• chore(deps): bump github/codeql-action from 4.37.5 to 4.37.6 in the github-actions group #​383 (dependabot[bot])
• docs: update CLAUDE.md with lifecycle/log files and updated recovery details #​382 (suchitd)
• chore(deps): bump github/codeql-action from 4.37.4 to 4.37.5 in the github-actions group #​381 (dependabot[bot])
• chore(deps): bump github/codeql-action from 4.37.3 to 4.37.4 in the github-actions group #​378 (dependabot[bot])
• chore(deps): bump github/codeql-action from 4 to 4.37.3 in the github-actions group #​374 (dependabot[bot])

v1.12.0

Compare Source

Full Changelog

Implemented enhancements:

• feat: skip-and-continue topology recovery with per-entity error surfacing #​365 (suchitd)
• Make TopologyRecoveryAllEnabled the default topology recovery mode #​362 (suchitd)
• feature: implement automatic topology recovery #​357 (suchitd)

Fixed bugs:

• Evict auto-delete queues and exchanges from topology store to prevent stale resurrection during recovery #​368
• Data race in Connection.shutdown between buffered listener send goroutine and close(listener) #​360
• fix: reject frames exceeding negotiated frame_max before allocation #​369 (suchitd)
• fix: prevent recursive channel recovery during connection reconnection #​367 (suchitd)
• fix: eliminate multiple data races in Channel and Connection operations #​366 (suchitd)
• fix: forget auto-delete topology on last consumer/binding removal #​363 (suchitd)
• fix: explicitly enforce TLS 1.2 minimum version in tlsConfigFromURI #​355 (suchitd)
• fix: return error when shortstr exceeds 255 bytes #​354 (suchitd)
• fix: enforce AMQP minimum frame size during negotiation #​353 (suchitd)
• fix: URL-encode TLS file paths in URI.String() query string #​352 (suchitd)
• Reject negative prefetch values in Qos #​351 (suchitd)
• fix: redact and zero out plaintext SASL credentials after handshake #​350 (suchitd)
• Avoid notifications blocking reader. #​349 (MirahImage)
• Return error when longstring too long. #​347 (MirahImage)
• Cap body pre-allocation to FrameMax. #​346 (MirahImage)
• Safely handle negative x- field length. #​344 (MirahImage)

Merged pull requests:

• chore(deps): bump actions/setup-go from 6 to 7 in the github-actions group #​370 (dependabot[bot])
• docs: update CLAUDE.md to document automatic recovery and new notify methods #​359 (suchitd)
• chore(deps): bump actions/cache from 5 to 6 in the github-actions group #​358 (dependabot[bot])
• chore(deps): bump actions/checkout from 6 to 7 in the github-actions group #​356 (dependabot[bot])

v1.11.0

Compare Source

Full Changelog

Implemented enhancements:

• Feature: implement automatic connection and channel recovery with state change notifications #​339 (suchitd)
• Add integration test for publish with immediate flag #​338 (suchitd)
• Add integration tests for QueueUnbind and QueuePurge #​337 (suchitd)
• Add integration test for exchange-to-exchange binding and unbinding #​336 (suchitd)

Fixed bugs:

• Fix Client example to work with RabbitMQ 4.3 #​341 (suchitd)
• Update CONTRIBUTING.md and .gitignore files #​335 (suchitd)
• Fix inconsistencies in the Makefile #​334 (suchitd)
• Fix integration tests for RabbitMQ 4.3 #​331 (suchitd)

Closed issues:

• PublishWithContext does not respect context cancellation #​329

Merged pull requests:

• doc: remove auto-reconnect from non-goals in README #​343 (suchitd)
• Add CLAUDE.md to repo #​342 (Zerpet)
• Bump CI windows workflow RabbitMQ and Erlang versions #​333 (suchitd)
• Add pull request template #​332 (suchitd)

v1.10.0

Compare Source

Full Changelog

Implemented enhancements:

• Undeprecate non-context publish functions #​259 (Zerpet)
• Update Go directive #​257 (Zerpet)

Fixed bugs:

• republishing on reconnect bug in the example #​249
• Channel Notify Close not receive event when connection is closed by RMQ server. #​241
• Inconsistent documentation #​231
• Data race in the client example #​72
• Fix string function of URI #​258 (Zerpet)

Closed issues:

• Documentation needed (PublishWithContext does not use context) #​195
• concurrent dispatch data race #​226

Merged pull requests:

• Fix data race in example #​260 (Zerpet)
• Address CodeQL warning #​252 (lukebakken)
• Add support for additional AMQP URI query parameters #​251 (vilius-g)
• Example fix #​250 (Boris-Plato)
• Increasing the code coverage #​248 (edercarloscosta)
• Use correct mutex to guard confirms.published #​240 (hjr265)
• Documenting Publishing.Expiration usage #​232 (niksteff)
• fix comment typo in example_client_test.go #​228 (wisaTong)
• Bump go.uber.org/goleak from 1.2.1 to 1.3.0 #​227 (dependabot[bot])

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.