Memory Allocation Vulnerability in RabbitMQ AMQP Client

CVE-2026-77410

What is CVE-2026-77410?

The RabbitMQ amqp091-go client, which serves as a Go implementation of the AMQP 0.9.1 protocol, is susceptible to a vulnerability that allows a malicious broker to exploit memory allocation. Prior to version 1.13.0, the Channel.recvContent function would preallocate a message body slice based on a potentially excessive size declared by a malicious AMQP content header. This unbounded allocation can lead to the Go runtime trying to allocate a large amount of memory before any actual body data is received, potentially exhausting system memory and terminating the client process. This issue has been addressed in version 1.13.0.

References