Vulnerability details

CVE-2026-77408

rabbitmq amqp091-go

RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow

CVSS 4.0

9.1Critical

Official description

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.

CVSS scores

Score	Version	Source	Vector
9.1Critical	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:L`

Affected products

Vendor	Product	Versions	Source
rabbitmq	amqp091-go	< 1.13.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-j497-x9hr-x34x x_refsource_CONFIRM
https://github.com/rabbitmq/amqp091-go/pull/354 x_refsource_MISC
https://github.com/rabbitmq/amqp091-go/commit/6959423aa2784a1971e399175dfb2065dea0f3b0 x_refsource_MISC
https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-16
Last updated: 2026-09-16
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.52%

Probability of exploitation in 30 days

44.6%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-190
Integer Overflow or Wraparound