Skip to content
OpenAdvisories
High · 8.2 CVE-2026-77409 EUVD-2026-80822

RabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel Blocking

Published Sep 16, 2026 · Updated Sep 18, 2026 · Assigned by GitHub_M

Description

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.dispatch in channel.go, confirms.confirm in confirms.go, and Connection.dispatch0 in connection.go synchronously send publisher confirmations, flow-control events, consumer cancellations, returned messages, including NotifyConfirm events and connection block notifications, to application-provided channels. If a listener channel is unbuffered, full, or not drained promptly, the sole reader goroutine blocks and stops processing frames, acknowledgments, deliveries, and heartbeats. Broker-driven event bursts can therefore cause connection stalls, missed heartbeats, deadlocks, and disconnection. This issue is fixed in version 1.13.0.

Affected products

VendorProductAffectedFixed
rabbitmq amqp091-go < 1.13.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 golang-github-rabbitmq-amqp091-go 1.14.0-1 —
Debian 13 golang-github-rabbitmq-amqp091-go No fix yet —
Debian 12 golang-github-rabbitmq-amqp091-go No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-github-rabbitmq-amqp091-go No fix yet —
Ubuntu 26.04 LTS golang-github-rabbitmq-amqp091-go No fix yet —
Ubuntu 24.04 LTS golang-github-rabbitmq-amqp091-go No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 opentelemetry-collector-contrib 0.161.0-0.1.hum1 RHSA-2026:68290

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 keda No fix yet —
Azure Linux 3 telegraf 1.31.0-34 —

Advisories 1

References