Vulnerability GHSA-xwwf-m8fg-p9q2

Summary

A Denial of Service (DoS) vulnerability exists in the AMQP client's connection negotiation logic. The AMQP specification explicitly mandates a strict minimum frame size of 4096 bytes to prevent pathological packet fragmentation. While the library defines a frameMinSize = 4096 constant, the connection negotiation loop fails to enforce this boundary, blindly accepting whatever maximum frame size (FrameMax) the server advertises during the handshake.

If a client connects to a malicious or compromised AMQP broker that advertises an extremely low FrameMax (such as 1 byte), the negotiation succeeds. Consequently, every subsequent message transmission is forced to splinter into thousands or millions of single-byte frames, causing massive CPU overhead, thread contention, and a near-instantaneous application freeze.

Attack Vector

An attacker who compromises an upstream AMQP broker, performs a Man-in-the-Middle (MitM) interception, or tricks an application into connecting to an unauthorized external rogue broker can trigger this vulnerability:

1. Rogue Handshake: The client application connects to an AMQP endpoint controlled by the attacker.
2. Malicious Parameter Tuning: During the connection.tune phase, the rogue server returns a FrameMax value of 1.
3. Resource Exhaustion Trigger: The client completes the handshake successfully. As soon as the client attempts to publish a message or process traffic, the internal loop fragments the data into single-byte frames, spiking the host's CPU usage to 100% and disabling the application thread.