Threat Intelligence Database

CVE-2026-77409 is a high-severity vulnerability in the RabbitMQ amqp091-go client prior to version 1.13.0. It involves allocation of resources without limits or throttling, where synchronous sending of publisher confirmations and other events to application channels can cause blocking if the listener channel is unbuffered, full, or not drained promptly. This can lead to connection stalls, missed heartbeats, deadlocks, and disconnections. The issue is fixed in version 1.13.0.

CVE-2026-77411 affects the RabbitMQ amqp091-go client prior to version 1.13.0. The vulnerability arises from improper handling of oversized AMQP long string lengths in the readLongstr function, which returns an empty string and no error instead of an error. This causes the parser to become desynchronized, potentially allowing a malicious or compromised broker to disrupt connection integrity and availability by misinterpreting trailing bytes as valid fields or frames. The issue is fixed in version 1.13.0.

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compromised broker can encode a value such as 0xFFFFFFFF, which becomes -1 and causes a len out of range runtime panic. The panic escapes the network reader goroutine and terminates the client process, including during connection.start server properties or message header table parsing. This issue is fixed in version 1.13.0.