CVE-2026-77412: RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compromised broker can encode a value such as 0xFFFFFFFF, which becomes -1 and causes a len out of range runtime panic. The panic escapes the network reader goroutine and terminates the client process, including during connection.start server properties or message header table parsing. This issue is fixed in version 1.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQ amqp091-goto a version that resolves this vulnerability.Fixed in 1.13.0
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using amqp091-go versions before 1.13.0 are exposed when they connect to a malicious or compromised AMQP broker. The broker can trigger the panic during connection startup or while message header tables are parsed.
What does an attacker need to do to exploit it?
The attacker needs to control, compromise, or otherwise cause the client to process malicious broker-supplied AMQP data. They can encode an AMQP byte-array field with type tag x using a length such as 0xFFFFFFFF, which is interpreted as -1 and causes a runtime panic.
What should teams do if they cannot patch immediately?
The provided information identifies a malicious or compromised broker as the source of exploit data. Until upgrading, limit client connections to trusted brokers and investigate any unexpected client-process termination during connection startup or message header parsing.
How can I tell whether an application may already be affected?
Check whether it uses amqp091-go prior to version 1.13.0. Affected clients may terminate with a "len out of range" runtime panic when processing broker data, including server properties during connection.start or message header tables.