CVE-2026-77408 RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId,...

CVE-2026-77408 RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId,...

CVE-2026-77408 RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId,...

CVE-2026-77408

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId,...

CVE-2026-77408

RabbitMQ amqp091-go (a Go AMQP 0.9.1 client) is vulnerable to silent data truncation and state corruption prior to version 1.13.0 . The writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without rejecting values longer than 255 bytes. An application...

CVE-2026-77410: Memory Allocation with Excessive Size Value

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header.Size value supplied by an AMQP content header without capping the allocation to the negotiated Connection.Config.FrameSize value. A...

PT-2026-93794

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description A query parameter injection issue exists in the connection URI formatting logic. The URI.String function in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values...

PT-2026-93797

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description An information disclosure issue exists where PlainAuth values retain passwords as exported plaintext fields within Connection.Config.SASL after a successful PLAIN authentication handshak...

CVE-2026-77408: Integer Overflow or Wraparound

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId,...

CVE-2026-77407: Cleartext Storage of Sensitive Information in Memory

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those...

PT-2026-93798

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description A data integrity and protocol corruption issue exists in the property serialization logic of the AMQP client. When encoding AMQP short string shortstr fields, the writeShortstr function ...

CVE-2026-77406: Signed to Unsigned Conversion Error

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 o...

PT-2026-93796

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description A resource exhaustion issue exists in the Quality of Service configuration. The Qos function in channel.go accepts signed integers for the prefetchCount and prefetchSize parameters but...

CVE-2026-77403: Allocation of Resources Without Limits or Throttling

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Connection.openTune in connection.go accepts a server-advertised FrameMax below the AMQP frameMinSize value of 4096 bytes because the connection negotiation loop does not enforce the protocol minimum. A malicious or compromised AMQP...

CVE-2026-77404: Improper Encoding or Escaping of Output

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AMQPS query string instead of encoding them as URL query parameters with url.Values. If an application accepts a TLS asset path...

PT-2026-93793

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description A Denial of Service DoS issue exists in the connection negotiation logic. The client fails to enforce the AMQP protocol minimum frame size of 4096 bytes, defined by the frameMinSize...

PT-2026-93801

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description A stream desynchronization issue exists in the AMQP wire-protocol parser. When the readLongstr function in read.go encounters a declared AMQP longstr length exceeding 0x7FFFFFFF the...

PT-2026-93795

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description A security weakness exists in the tlsConfigFromURI function within uri.go when constructing a tls.Config object from an amqps:// connection URI. The library fails to explicitly set the...

PT-2026-93799

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description The Channel.dispatch function in channel.go, confirms.confirm in confirms.go, and Connection.dispatch0 in connection.go synchronously send publisher confirmations, flow-control events,...

PT-2026-93800

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0 Description A flaw in the recvContent function allows a malicious or compromised AMQP broker to trigger an Out-of-Memory OOM error, which is a state where the system lacks enough memory to perform...