Skip to content
OpenAdvisories
Critical · 9.5 CVE-2026-77411 EUVD-2026-80821GHSA-c5pq-fr2g-9jpfGO-2026-6496

RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr

Published Sep 16, 2026 · Updated Sep 16, 2026 · Assigned by GitHub_M

Description

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning ErrSyntax. The function leaves the declared field bytes unread, while readTable treats the operation as successful and continues parsing from the wrong offset. A malicious or compromised broker can provide an oversized longstr in a table field and desynchronize subsequent AMQP parsing, causing attacker-controlled trailing bytes to be interpreted as later fields or frames and disrupting connection integrity and availability. This issue is fixed in version 1.13.0.

Affected products

VendorProductAffectedFixed
rabbitmq amqp091-go < 1.13.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 golang-github-rabbitmq-amqp091-go 1.14.0-1 —
Debian 13 golang-github-rabbitmq-amqp091-go No fix yet —
Debian 12 golang-github-rabbitmq-amqp091-go No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-github-rabbitmq-amqp091-go No fix yet —
Ubuntu 26.04 LTS golang-github-rabbitmq-amqp091-go No fix yet —
Ubuntu 24.04 LTS golang-github-rabbitmq-amqp091-go No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 opentelemetry-collector-contrib 0.162.0-0.1.hum1 RHSA-2026:73523

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 keda No fix yet —
Azure Linux 3 telegraf 1.31.0-34 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/rabbitmq/amqp091-go < 1.13.0 1.13.0 GHSA-c5pq-fr2g-9jpf

Advisories 1

References