KrakenD allowed us to focus on our backend and deploy a secure and performant system in a few days. After more than 2 years of use in production and 0 crash or malfunction, it also has proven its robustness
Jonathan Muller
CTO / Openroom Inc.
CVE-2026-79921
CVE
High
· CVSS 8.6
Low ImpactExploiting this vulnerability requires an uncommon setup or configuration. Upgrading is still recommended when possible.
backend/amqp/consumer,
backend/amqp/producer, and async agents using the AMQP driver. The attack has to
come from the broker itself, so it requires the message broker to be malicious or
already compromised rather than an ordinary API client. Deployments that do not
connect to AMQP are not exposed.Component
RabbitMQ AMQP 0-9-1 client for Go (amqp091-go)
Disclosed
Sep 7, 2026
CVSS Score
8.6
frame_max, that both ends
must respect. The amqp091-go client did not enforce it on incoming content body
frames: a broker could send a valid basic.deliver sequence whose frame header
declares a payload larger than the negotiated limit, and the client allocated for the
declared size instead of closing the connection with a frame error as the
specification requires. A malicious or compromised broker can drive the client into
unbounded memory consumption and an application-layer denial of service. The fix
lands in amqp091-go 1.13.0, and no workaround exists for earlier versions.Community Edition
2.13.11
addresses this advisory
Affected CE versions
>= 2.0, < 2.13.11
Enterprise Edition
2.13.9
addresses this advisory
Affected EE versions
>= 2.0, < 2.13.9
Upgrade to the addressed version or later to remediate this vulnerability.
Stay up to date with KrakenD releases and important updates