Go AMQP Client Vulnerability in RabbitMQ Affecting Multiple Channels

CVE-2026-77409

What is CVE-2026-77409?

The RabbitMQ amqp091-go client, prior to version 1.13.0, contains a significant flaw in its handling of publisher confirmations and other critical events. This vulnerability arises from the synchronous nature of how various messages, including confirmations, flow-control events, and consumer cancellations, are dispatched to listener channels. When an unbuffered or already full channel is encountered, the channel's sole reading goroutine can block, halting the processing of important frames, acknowledgments, deliveries, and heartbeats. Such scenarios can lead to severe repercussions, including connection stalls, missed heartbeats, and potential deadlocks. This issue has been effectively addressed in version 1.13.0.

References