CVE-2026-77411: RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning ErrSyntax. The function leaves the declared field bytes unread, while readTable treats the operation as successful and continues parsing from the wrong offset. A malicious or compromised broker can provide an oversized longstr in a table field and desynchronize subsequent AMQP parsing, causing attacker-controlled trailing bytes to be interpreted as later fields or frames and disrupting connection integrity and availability. This issue is fixed in version 1.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
amqp091-goto a version that resolves this vulnerability.Fixed in 1.13.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Applications using the RabbitMQ amqp091-go client before version 1.13.0 are affected. Exploitation requires the client to process AMQP data from a malicious or compromised broker.
What does an attacker need to send to trigger the parsing failure?
The broker must supply an AMQP table field containing a longstr whose declared length exceeds 0x7FFFFFFF. The client then leaves the field bytes unread and parses subsequent attacker-controlled bytes at the wrong offset.
What is the practical impact of successful exploitation?
Subsequent AMQP data can be desynchronized, allowing trailing bytes to be interpreted as later fields or frames. This can disrupt connection integrity and availability.
What should be done to remediate the issue?
Upgrade amqp091-go to version 1.13.0, which fixes the handling of oversized longstr lengths.