Vulnerability · Published Sep 16, 2026 · Assigned by GitHub_M
CVE-2026-77406RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration
High 8.2
In plain English
A high-severity security flaw in amqp091-go from rabbitmq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 or 4294967295 instead of being rejected. An application that permits untrusted configuration of these Qos values can unintentionally request extremely large prefetch limits, allowing a broker to deliver enough queued messages to exhaust client memory and disrupt processing. This issue is fixed in version 1.13.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-rabbitmq-amqp091-go | no fix listed | DEBIAN-CVE-2026-77406 |
| Debian:13 | golang-github-rabbitmq-amqp091-go | no fix listed | DEBIAN-CVE-2026-77406 |
| Debian:14 | golang-github-rabbitmq-amqp091-go | 1.14.0-1 | DEBIAN-CVE-2026-77406 |
| Go | github.com/rabbitmq/amqp091-go | 1.13.0 | GO-2026-6502 |
| Go | github.com/rabbitmq/amqp091-go | 1.13.0 | GHSA-rm6m-hrcw-jw33 |
| Ubuntu:24.04:LTS | golang-github-rabbitmq-amqp091-go | no fix listed | UBUNTU-CVE-2026-77406 |
| Ubuntu:26.04:LTS | golang-github-rabbitmq-amqp091-go | no fix listed | UBUNTU-CVE-2026-77406 |
| Ubuntu:26.10 | golang-github-rabbitmq-amqp091-go | no fix listed | UBUNTU-CVE-2026-77406 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rabbitmq | amqp091-go | < 1.13.0 |
Weakness: CWE-195 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
References
- https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-rm6m-hrcw-jw33 x_refsource_CONFIRM
- https://github.com/rabbitmq/amqp091-go/pull/351 x_refsource_MISC
- https://github.com/rabbitmq/amqp091-go/commit/3b879e1d1d25b544e26b3bc3d7db3213203c0f3b x_refsource_MISC
- https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0 x_refsource_MISC