CVE-2026-77412: RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client
Summary A vulnerability in the readField function allows a malicious or compromised AMQP server to trigger an unhandled runtime panic in the client application, leading to an immediate crash of the entire process.
Details When parsing incoming AMQP frames, the readField function processes byte-array fields (type tag 'x') by reading a 32-bit big-endian integer to determine the length of the data payload.
go // read.go:253-263 case 'x': var len int32 if err = binary.Read(r, binary.BigEndian, &len); err != nil { return nil, err } value := make([]byte, len) // PANICS if len < 0
If a server transmits a length value of 0xFFFFFFFF, it is interpreted by the client as a signed 32-bit integer with a value of -1. Passing a negative integer to Go's built-in make() function for slice allocation triggers an unrecoverable runtime panic (panic: len out of range).
Because the reader goroutine handles network I/O without an explicit recover() wrapper, this panic propagates up to the runtime root, abruptly terminating the host application.
Attack Vector / Exploitation Scenario An attacker capable of spoofing, compromising, or controlling an AMQP broker can exploit this flaw during two primary phases:
1. Connection Establishment: Sending a malicious connection.start handshake frame containing server-properties with an 'x' type field assigned a negative length. 2. Message Delivery: Delivering a message payload where the header table contains a malformed field matching the criteria above.
Impact Availability: High. A single malformed frame can reliably crash the client process, resulting in a persistent Denial of Service (DoS) if the client automatically reconnects and receives the same payload.
Other sources
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compromised broker can encode a value such as 0xFFFFFFFF, which becomes -1 and causes a len out of range runtime panic. The panic escapes the network reader goroutine and terminates the client process, including during connection.start server properties or message header table parsing. This issue is fixed in version 1.13.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/rabbitmq/amqp091-goto a version that resolves this vulnerability.Fixed in 1.13.0 - Upgrade
Upgrade
RabbitMQ amqp091-goto a version that resolves this vulnerability.Fixed in 1.13.0 - Compensating control
Treat the AMQP broker as untrusted: ensure the client only connects to a trusted, authenticated broker (e.g., prevent spoofing/compromise via network access controls and strong AMQP authentication) to avoid an attacker sending malicious connection.start server-properties or message headers that can crash the client.
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Applications using amqp091-go versions before 1.13.0 are exposed when they connect to a malicious or compromised AMQP broker. The broker can trigger the panic during connection startup or while message header tables are parsed.
What does an attacker need to do to exploit it?
The attacker needs to control, compromise, or otherwise cause the client to process malicious broker-supplied AMQP data. They can encode an AMQP byte-array field with type tag x using a length such as 0xFFFFFFFF, which is interpreted as -1 and causes a runtime panic.
What should teams do if they cannot patch immediately?
The provided information identifies a malicious or compromised broker as the source of exploit data. Until upgrading, limit client connections to trusted brokers and investigate any unexpected client-process termination during connection startup or message header parsing.
How can I tell whether an application may already be affected?
Check whether it uses amqp091-go prior to version 1.13.0. Affected clients may terminate with a "len out of range" runtime panic when processing broker data, including server properties during connection.start or message header tables.