CVE-2026-77406: RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 or 4294967295 instead of being rejected. An application that permits untrusted configuration of these Qos values can unintentionally request extremely large prefetch limits, allowing a broker to deliver enough queued messages to exhaust client memory and disrupt processing. This issue is fixed in version 1.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQ amqp091-goto a version that resolves this vulnerability.Fixed in 1.13.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using amqp091-go before version 1.13.0 are exposed if untrusted input can control the prefetchCount or prefetchSize arguments passed to Channel.Qos. The resulting oversized prefetch request can cause the broker to deliver enough queued messages to exhaust the client's memory.
What input is needed to trigger the oversized prefetch request?
A negative Qos prefetchCount or prefetchSize value is required. For example, -1 is cast to 65535 for the uint16 prefetch-count field or 4294967295 for the uint32 prefetch-size field instead of being rejected.
What can be done before upgrading?
Do not allow untrusted configuration or user input to set Channel.Qos prefetchCount or prefetchSize. Validate these values before calling Channel.Qos and reject negative values.
How can I determine whether an application may be affected?
Review calls to Channel.Qos in applications using amqp091-go versions earlier than 1.13.0. Investigate whether either Qos value can originate from external configuration, user-controlled input, or any source that could supply a negative integer.