AMQP Go Client Vulnerability in RabbitMQ Affects Metadata Integrity
CVE-2026-77408

9.1CRITICAL

Key Information:

Vendor

RabbitMQ

Status
AMQp091-go
Vendor
CVE Published:
16 September 2026

What is CVE-2026-77408?

The RabbitMQ amqp091-go client for Go exposes a vulnerability where the writeShortstr function improperly handles byte length for AMQP shortstr property values. Specifically, it casts values longer than 255 bytes to uint8 without prior rejection. Applications using this client may accept oversized values for properties such as CorrelationId and MessageId, leading to silent metadata corruption. This can disrupt request-reply correlation, routing, and overall message processing integrity. This issue has been addressed in version 1.13.0.

Affected Version(s)

amqp091-go < 1.13.0

References

https://github.com/rabbitmq/amqp091-go/security/advisorie...
x_refsource_CONFIRM
https://github.com/rabbitmq/amqp091-go/pull/354
x_refsource_MISC
https://github.com/rabbitmq/amqp091-go/commit/6959423aa27...
x_refsource_MISC

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.