Hi,

The following vulnerability was published for golang-github-rabbitmq-amqp091-go.

CVE-2026-79921[0]:
| amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a
| compromised or malicious AMQP broker can force the client to
| allocate resources for and process content body frames that exceed
| the negotiated frame_max limit. This can lead to unexpected memory
| consumption or application-layer denial of service (DoS), bypassing
| the protocol's built-in framing constraints. Version 1.13.0 contains
| a fix. No known workarounds are available.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-79921
https://www.cve.org/CVERecord?id=CVE-2026-79921
[1] https://github.com/rabbitmq/amqp091-go/pull/353
[2] https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp
[3] https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
golang-github-rabbitmq-amqp091-go, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1145982@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon Josefsson <simon@josefsson.org> (supplier of updated golang-github-rabbitmq-amqp091-go package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 28 Aug 2026 22:15:14 +0200
Source: golang-github-rabbitmq-amqp091-go
Architecture: source
Version: 1.14.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Simon Josefsson <simon@josefsson.org>
Closes: 1145982
Changes:
 golang-github-rabbitmq-amqp091-go (1.14.0-1) unstable; urgency=medium
 .
   * Team upload
   * New upstream fixing CVE-2026-79921 (Closes: #1145982)
   * Bump compat to 14
   * Bump debian/* copyright years
   * Use dh-sequence-golang
   * Use watch v5
   * Use gbp sign-tags
   * Use gbp upstream-vcs-tag
Checksums-Sha1:
 462e5669f7f696a909857fe5d594d0729b222a17 2638 golang-github-rabbitmq-amqp091-go_1.14.0-1.dsc
 0a8e03e2649f29623bb06810c336dab22cd01431 154280 golang-github-rabbitmq-amqp091-go_1.14.0.orig.tar.xz
 81b0fa66aaf2a53e94a267a419b8ef479d6424bd 2864 golang-github-rabbitmq-amqp091-go_1.14.0-1.debian.tar.xz
 6ab1925d4a3398e9f7769737014668367a485acb 390316 golang-github-rabbitmq-amqp091-go_1.14.0-1.git.tar.xz
 5354ec757ab355186eab472e8bb2ac8e20f1684f 17776 golang-github-rabbitmq-amqp091-go_1.14.0-1_source.buildinfo
Checksums-Sha256:
 e482c3ab5a83683d39f01830da347917e324778a5ec7e2d1f0b51d5c27363ce8 2638 golang-github-rabbitmq-amqp091-go_1.14.0-1.dsc
 d8c2c2c81e2ba56d64158517ccbd477ae78d303049096668270ce6bbcfa516e5 154280 golang-github-rabbitmq-amqp091-go_1.14.0.orig.tar.xz
 78188f89244004e869e5101784cc59a0f579052785f7668c5faf5d62bc35d340 2864 golang-github-rabbitmq-amqp091-go_1.14.0-1.debian.tar.xz
 c581631e0d0e12ce23371308656ae12cceb52a392b1978e57234bd1d60934abc 390316 golang-github-rabbitmq-amqp091-go_1.14.0-1.git.tar.xz
 2c831a700f31939c7b136b099d0609f0a8f7a8290f4e2d763cac1321a6b86956 17776 golang-github-rabbitmq-amqp091-go_1.14.0-1_source.buildinfo
Files:
 2088dfe145d5477cf15d3600bbc4f1fd 2638 golang optional golang-github-rabbitmq-amqp091-go_1.14.0-1.dsc
 19d8ed7b2f443b4df6a2355849d13af6 154280 golang optional golang-github-rabbitmq-amqp091-go_1.14.0.orig.tar.xz
 a95327ab77523576d6a5c9f803820e8a 2864 golang optional golang-github-rabbitmq-amqp091-go_1.14.0-1.debian.tar.xz
 b7fd6a0c1a6cce63afdf495feb861d8a 390316 golang None golang-github-rabbitmq-amqp091-go_1.14.0-1.git.tar.xz
 fc2ead059b291fe839d5cf655b9280f6 17776 golang optional golang-github-rabbitmq-amqp091-go_1.14.0-1_source.buildinfo
Git-Tag-Info: tag=f456b56b50149abac1f0224ae6a2f1e2dcef9acf fp=a3cc9c870b9d310abad4cf2f51722b08fe4745a2
Git-Tag-Tagger: Simon Josefsson <simon@josefsson.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqR+HkACgkQYG0ITkaD
wHnU+g//d+nlVBDNFrIi3uyAsoyJypN1uWUqpN+PC+3wm35jldAZqOyzeUnfzm7f
AT3bg/lIFzge2XRl6DwGk/CBe7t7KZhEEg66YUYb596jPyBISlBSAtruEunIoc3P
R8msRinbJLNQ4gMDlWfA7ERyQsIrLLFw2Zr+p5e/uwmjuBYQHBkSjIUw9jD7jznW
PaKQuBq2A7swG+miSO0KT9gwm4zuzg6fwXoCqT/KvJiNom/PD+/gNC4/cX9v1JXw
PxI8Qa0Qfas85VuMkxTHCT+0S8AJTlJItWw8YwWWQIm8hgUY4S7hfDHdLaJ29LqD
p+lJoJImFfiedUrcaohCwOVZNylwvCnK4jxyYhGMBN2+cqwfRpsVAMPwszOpdVVL
N7oSsdS+Gc91NRRMN27R9Zm63f43L3p0ytXjxgMBl2nRBtHrxj3nWlRMMS3MlEXq
YDfyfyoYnoz5Mdi/2PYA9VrU9zc2pu89hCXzMsutHP/j7UsqqQBr+W/lTv7Vi/kR
Z85Wxh9JrjjjqYD96g7annWw3L52OSH0nP4K4jiVKSjKEvhPJYR4oBPC18m6n2WP
tcOk+wQYnLA9FbB+8SYh6UoAX6cTVUjKKB4yUBzJQ+vOZSXJSh0xJ9GdHHclrHIc
A8gALj1tidjF9d1o+/c+HPgffgUOf6RO2pBPyFKO5iovByjj//k=
=quny
-----END PGP SIGNATURE-----