Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly points to the recvContent function as the source of the flaw, stating that it attempts to optimize performance by pre-allocating memory based on ch.header.Size without validation. The provided commit 91b65fa0096a99a580cf51a31b24028ff1c60382 directly modifies the channel.go file within the recvContent function. The patch shows the addition of logic to cap the headerSize with ch.connection.Config.FrameSize before the make([]byte, 0, headerSize) call. This confirms that the Channel.recvContent function was the exact location where the unbounded memory allocation occurred, making it the vulnerable function. When an attacker sends a message with an excessively large body-size in the content header, this function would be called to process the incoming content, leading to the OOM condition.
Channel.recvContentchannel.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/rabbitmq/amqp091-go | go | < 1.13.0 | 1.13.0 |