Vulnerability · Published Sep 16, 2026 · Assigned by GitHub_M
CVE-2026-77408RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow
Critical 9.1
In plain English
A critical-severity integer overflow in amqp091-go from rabbitmq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-github-rabbitmq-amqp091-go | no fix listed | DEBIAN-CVE-2026-77408 |
| Debian:13 | golang-github-rabbitmq-amqp091-go | no fix listed | DEBIAN-CVE-2026-77408 |
| Debian:14 | golang-github-rabbitmq-amqp091-go | 1.14.0-1 | DEBIAN-CVE-2026-77408 |
| Go | github.com/rabbitmq/amqp091-go | 1.13.0 | GO-2026-6498 |
| Go | github.com/rabbitmq/amqp091-go | 1.13.0 | GHSA-j497-x9hr-x34x |
| Ubuntu:24.04:LTS | golang-github-rabbitmq-amqp091-go | no fix listed | UBUNTU-CVE-2026-77408 |
| Ubuntu:26.04:LTS | golang-github-rabbitmq-amqp091-go | no fix listed | UBUNTU-CVE-2026-77408 |
| Ubuntu:26.10 | golang-github-rabbitmq-amqp091-go | no fix listed | UBUNTU-CVE-2026-77408 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rabbitmq | amqp091-go | < 1.13.0 |
Weakness: CWE-190 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:L
References
- https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-j497-x9hr-x34x x_refsource_CONFIRM
- https://github.com/rabbitmq/amqp091-go/pull/354 x_refsource_MISC
- https://github.com/rabbitmq/amqp091-go/commit/6959423aa2784a1971e399175dfb2065dea0f3b0 x_refsource_MISC
- https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0 x_refsource_MISC