AZL-103290 CVE-2026-77411 affecting package telegraf 1.31.0-33

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning ErrSyntax. The function leaves the declared field bytes unread, while readTable treats the...

AZL-103275 CVE-2026-77408 affecting package telegraf 1.31.0-33

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId,...

CVE-2026-77411

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning ErrSyntax. The function leaves the declared field bytes unread, while readTable treats the...

CVE-2026-77403

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP...

CVE-2026-77405: Inadequate Encryption Strength

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when...

CVE-2026-77408: Integer Overflow or Wraparound

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId,...

CVE-2026-77411: Improper Check for Unusual or Exceptional Conditions

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning ErrSyntax. The function leaves the declared field bytes unread, while readTable treats the...

PT-2026-93801

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description A stream desynchronization issue exists in the AMQP wire-protocol parser. When the readLongstr function in read.go encounters a declared AMQP longstr length exceeding 0x7FFFFFFF the...

rabbitmq-server: RabbitMQ: Denial of Service via AMQP 0-9-1 body size validation bypass

A flaw was found in RabbitMQ. An authenticated AMQP 0-9-1 client with publish permissions can exploit a vulnerability in the body assembly process. By declaring an extremely large BodySize and streaming message fragments, the client can bypass size validation, leading to unbounded memory...

rabbitmq-server: RabbitMQ: Denial of Service via AMQP 1.0 array32 parsing

A flaw was found in RabbitMQ. An unauthenticated network attacker can exploit an issue in the AMQP 1.0 listener by sending a specially crafted 19-byte frame. This causes the system to attempt to build a list of approximately 4 billion empty elements, exhausting heap memory and terminating the...

rabbitmq-server: rabbitmq-server: Unauthorized user impersonation via stale OAuth token refresh

A flaw was found in rabbitmq-server. When an existing Advanced Message Queuing Protocol AMQP connection refreshes its authentication token to one with revoked impersonation privileges, the server fails to update the active session's security tags. As a result, an authenticated user can retain...

rabbitmq-server: rabbitmq-server: Unauthorized message routing via missing alternate-exchange permission check

A flaw was found in rabbitmq-server. This vulnerability allows an authenticated user to bypass access controls and perform unauthorized message routing. When an exchange is declared via the Advanced Message Queuing Protocol AMQP 1.0 management interface, the application fails to verify write...

rabbitmq: RabbitMQ: Information disclosure of AMQP 1.0 shovel URI passwords

A flaw was found in RabbitMQ, a messaging and streaming broker. The AMQP 1.0 shovel component incorrectly stores connection Uniform Resource Identifiers URIs with embedded plaintext passwords. This information can be exposed to an authenticated attacker with monitoring privileges via the...

rabbitmq: RabbitMQ: Information disclosure of decrypted Shovel URIs in debug logs

A flaw was found in RabbitMQ, a messaging and streaming broker. When the Shovel plugin is enabled with URI-embedded credentials and debug logging is active, the completion of an autodelete shovel can cause decrypted AMQP Advanced Message Queuing Protocol URIs, including usernames and passwords, t...

RabbitMQ: RabbitMQ: Denial of Service via crafted AMQP 1.0 SQL LIKE filter

A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated AMQP 1.0 consumer with read and write permissions on a stream queue can exploit a Regular Expression Denial of Service ReDoS vulnerability. This occurs when a crafted LIKE filter is processed, leading to excessive CP...

rabbitmq-server: RabbitMQ: Denial of Service due to atom-table exhaustion via reply-to queue name decoding

A flaw was found in RabbitMQ, a messaging and streaming broker. An authenticated AMQP Advanced Message Queuing Protocol client can trigger an atom-table exhaustion by sending specially crafted reply-to queue names for decoding. This can lead to the entire Erlang Virtual Machine VM crashing,...

CLSA-2026-1789453747 TuxCare security update for org.springframework.amqp (1 CVE)

TuxCare rebuilt 4 org.springframework.amqp packages to address 1 CVE. Fixed in 2.3.7-tuxcare.1...

rabbitmq-c -- remote client-side memory exhaustion

The rabbitmq-c project reports: A malicious AMQP peer can trigger memory exhaustion in rabbitmq-c clients by sending frames with unrecognised types or invalid channel numbers. The client allocates per-channel memory pools and stores complete frames before validating the channel against the...

CLSA-2026-1789371263 TuxCare security update for org.springframework.amqp (3 CVEs)

TuxCare rebuilt 7 org.springframework.amqp packages to address 3 CVEs. Fixed in 3.2.12-tuxcare.1...

Updated librabbitmq packages fix security vulnerabilities

amqpdecodebytes sizet integer overflow bypasses bounds check on 32-bit OOB read. CVE-2026-59986 Heap Buffer Overflow in amqpsendframe When Serializing Oversized AMQPFRAMEBODY. CVE-2026-61547...