Critical severity · published Sep 16, 2026
CVE-2026-77408
RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow
9.1
CVSS
0.5%
EPSS
No
On KEV
Description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
amqp091-go · rabbitmq
< 1.13.0 · source: vendor
Affected product
AM
amqp091-go
rabbitmq
More from amqp091-go
9.5
CVE-2026-77411
RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr
9.4
CVE-2026-77405
RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser
8.9
CVE-2026-77412
RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client
8.9
CVE-2026-77410
RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation
8.9
CVE-2026-77403
RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation