Most recent entries from all

CLEANSTART-2026-KU86839 — RabbitMQ amqp091-go is a Go AMQP 0

Affected: CleanStart: opentelemetry-collector-contrib

Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0.

fkie_cve-2026-77406

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 or 4294967295 instead of being rejected. An application that permits untrusted configuration of these Qos values can unintentionally request extremely large prefetch limits, allowing a broker to deliver enough queued messages to exhaust client memory and disrupt processing. This issue is fixed in version 1.13.0.

GHSA-rm6m-hrcw-jw33 — RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration

Affected: Go: github.com/rabbitmq/amqp091-go

## Summary A logic and resource exhaustion vulnerability exists in the AMQP client's Quality of Service (`Qos`) configuration method. The `Qos` function accepts signed integers (`int`) for the `prefetchCount` and `prefetchSize` parameters but casts them directly to unsigned integers (`uint16` and `uint32`, respectively) when formatting the wire-level frame.

If a developer passes a negative integer (such as `-1`) to these parameters—frequently intended as a sentinel value meaning "no change" or "no limit"—the application performs an implicit signed-to-unsigned conversion. This wraps the values to their absolute maximum limit ($65535$ and $4294967295$). Consequently, a consumer expecting restricted message delivery rates is suddenly flooded with an unlimited volume of messages, potentially exhausting memory resources and crashing the application.

---

## Vulnerability Details

### Mechanism The bug manifests during the structural assignment inside the channel's `Qos` method:

```go // channel.go:795-796 PrefetchCount: uint16(prefetchCount), // -1 wraps to 65535 PrefetchSize: uint32(prefetchSize), // -1 wraps to 4294967295 ```

In Go, converting a negative signed integer to an unsigned integer shifts the value via two's complement arithmetic. Because no boundary validation or signedness check occurs prior to the cast: * Passing `-1` for `prefetchCount` yields a wire value of `65535`. * Passing `-1` for `prefetchSize` yields a wire value of `4294967295`.

### Impact The AM…

msrc_CVE-2026-77406 — RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration

msrc_CVE-2026-77406

RHSA-2026:68290 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via AMQP frame size negotiation github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Connection configuration overwrite via unsanitized TLS path parameter injection github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via signed-to-unsigned integer casting github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Fields github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service due to synchronous event channel blocking github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via unbounded body buffer allocation github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via Malicious AMQP Field Length go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission