Vulnerability-Lookup

CVE-2026-77412 (GCVE-0-2026-77412)

Vulnerability from cvelistv5 – Published: 2026-09-16 14:43 – Updated: 2026-09-16 15:05

Title

RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client

Summary

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compromised broker can encode a value such as 0xFFFFFFFF, which becomes -1 and causes a len out of range runtime panic. The panic escapes the network reader goroutine and terminates the client process, including during connection.start server properties or message header table parsing. This issue is fixed in version 1.13.0.

Severity

8.9 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 15:05 UTC

CWE

CWE-681 - Incorrect Conversion between Numeric Types

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/rabbitmq/amqp091-go/security/a…	x_refsource_CONFIRM
https://github.com/rabbitmq/amqp091-go/pull/344	x_refsource_MISC
https://github.com/rabbitmq/amqp091-go/commit/669…	x_refsource_MISC
https://github.com/rabbitmq/amqp091-go/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
rabbitmq	amqp091-go	Affected: < 1.13.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77412",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T15:05:07.698557Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:05:14.135Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "amqp091-go",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compromised broker can encode a value such as 0xFFFFFFFF, which becomes -1 and causes a len out of range runtime panic. The panic escapes the network reader goroutine and terminates the client process, including during connection.start server properties or message header table parsing. This issue is fixed in version 1.13.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-681",
              "description": "CWE-681: Incorrect Conversion between Numeric Types",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:43:46.302Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3"
        },
        {
          "name": "https://github.com/rabbitmq/amqp091-go/pull/344",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/pull/344"
        },
        {
          "name": "https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf"
        },
        {
          "name": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-4v58-74mf-rjx3",
        "discovery": "UNKNOWN"
      },
      "title": "RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77412",
    "datePublished": "2026-09-16T14:43:46.302Z",
    "dateReserved": "2026-08-20T19:55:27.024Z",
    "dateUpdated": "2026-09-16T15:05:14.135Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-77412",
      "date": "2026-10-17",
      "epss": "0.00524",
      "percentile": "0.43175"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "amqp091-go",
                "vendor": "rabbitmq",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.13.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compromised broker can encode a value such as 0xFFFFFFFF, which becomes -1 and causes a len out of range runtime panic. The panic escapes the network reader goroutine and terminates the client process, including during connection.start server properties or message header table parsing. This issue is fixed in version 1.13.0."
          }
        ],
        "id": "CVE-2026-77412",
        "lastModified": "2026-09-23T18:19:19.803",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.9,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-77412",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T15:05:07.698557Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-16T15:17:50.707",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rabbitmq/amqp091-go/pull/344"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-681"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-09T00:47:04+00:00",
      "cve": "CVE-2026-77412",
      "id": "CVE-2026-77412",
      "initial_release_date": "2026-09-16T14:43:46.302000+00:00",
      "product_status:fixed": "13",
      "product_status:known_affected": "6",
      "product_status:known_not_affected": "69",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service via Malicious AMQP Field Length",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77412.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-17T16:58:55Z",
      "cve": "CVE-2026-77412",
      "id": "CVE-2026-77412",
      "initial_release_date": "2026-09-17T16:58:55Z",
      "product_status:known_affected": "9",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-77412",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-77412.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-77412",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-16T15:05:07.698557Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-16T15:05:10.273Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "amqp091-go",
              "vendor": "rabbitmq",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.13.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compromised broker can encode a value such as 0xFFFFFFFF, which becomes -1 and causes a len out of range runtime panic. The panic escapes the network reader goroutine and terminates the client process, including during connection.start server properties or message header table parsing. This issue is fixed in version 1.13.0."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 8.9,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "HIGH",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-681",
                  "description": "CWE-681: Incorrect Conversion between Numeric Types",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-16T14:43:46.302Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3"
            },
            {
              "name": "https://github.com/rabbitmq/amqp091-go/pull/344",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rabbitmq/amqp091-go/pull/344"
            },
            {
              "name": "https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf"
            },
            {
              "name": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
            }
          ],
          "source": {
            "advisory": "GHSA-4v58-74mf-rjx3",
            "discovery": "UNKNOWN"
          },
          "title": "RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-77412",
        "datePublished": "2026-09-16T14:43:46.302Z",
        "dateReserved": "2026-08-20T19:55:27.024Z",
        "dateUpdated": "2026-09-16T15:05:14.135Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CLEANSTART-2026-JY06223 (CVE-2026-77412)

Vulnerability from cleanstart – Published: 2026-09-19 00:39 – Updated: 2026-10-09 03:13 – Source website

Summary

RabbitMQ amqp091-go is a Go AMQP 0

Details

Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0.

Severity

8.9 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-77412	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-77412	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "opentelemetry-collector-contrib",
        "purl": "pkg:apk/cleanstart/opentelemetry-collector-contrib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.160.0-r2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0.",
  "id": "CLEANSTART-2026-JY06223",
  "modified": "2026-10-09T03:13:56Z",
  "published": "2026-09-19T00:39:28.060129Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JY06223.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-77412"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77412"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "RabbitMQ amqp091-go is a Go AMQP 0",
  "upstream": [
    "CVE-2026-77412"
  ]
}

CLEANSTART-2026-PK85962 (CVE-2026-77412)

Vulnerability from cleanstart – Published: 2026-10-15 00:41 – Updated: 2026-10-14 06:10 – Source website

Summary

RabbitMQ amqp091-go is a Go AMQP 0

Details

Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0.

Severity

8.9 (High)


                    
                      CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-77412	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-77412	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "opentelemetry-collector-contrib",
        "purl": "pkg:apk/cleanstart/opentelemetry-collector-contrib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.159.0-r4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0.",
  "id": "CLEANSTART-2026-PK85962",
  "modified": "2026-10-14T06:10:06Z",
  "published": "2026-10-15T00:41:33.234364Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PK85962.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-77412"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77412"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "RabbitMQ amqp091-go is a Go AMQP 0",
  "upstream": [
    "CVE-2026-77412"
  ]
}

FKIE_CVE-2026-77412

Vulnerability from fkie_nvd - Published: 2026-09-16 15:17 - Updated: 2026-09-23 18:19

Severity

8.9 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf
	security-advisories@github.com	https://github.com/rabbitmq/amqp091-go/pull/344
	security-advisories@github.com	https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0
	security-advisories@github.com	https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "amqp091-go",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compromised broker can encode a value such as 0xFFFFFFFF, which becomes -1 and causes a len out of range runtime panic. The panic escapes the network reader goroutine and terminates the client process, including during connection.start server properties or message header table parsing. This issue is fixed in version 1.13.0."
    }
  ],
  "id": "CVE-2026-77412",
  "lastModified": "2026-09-23T18:19:19.803",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.9,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77412",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T15:05:07.698557Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-16T15:17:50.707",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rabbitmq/amqp091-go/pull/344"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-681"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4V58-74MF-RJX3

Vulnerability from github – Published: 2026-09-17 17:04 – Updated: 2026-09-17 17:04

Summary

RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client

Details

Summary A vulnerability in the readField function allows a malicious or compromised AMQP server to trigger an unhandled runtime panic in the client application, leading to an immediate crash of the entire process.

Details When parsing incoming AMQP frames, the readField function processes byte-array fields (type tag 'x') by reading a 32-bit big-endian integer to determine the length of the data payload.

// read.go:253-263
case 'x':
    var len int32
    if err = binary.Read(r, binary.BigEndian, &len); err != nil {
        return nil, err
    }
    value := make([]byte, len)  // PANICS if len < 0

If a server transmits a length value of 0xFFFFFFFF, it is interpreted by the client as a signed 32-bit integer with a value of -1. Passing a negative integer to Go's built-in make() function for slice allocation triggers an unrecoverable runtime panic (panic: len out of range).

Because the reader goroutine handles network I/O without an explicit recover() wrapper, this panic propagates up to the runtime root, abruptly terminating the host application.

Attack Vector / Exploitation Scenario An attacker capable of spoofing, compromising, or controlling an AMQP broker can exploit this flaw during two primary phases:

Connection Establishment: Sending a malicious connection.start handshake frame containing server-properties with an 'x' type field assigned a negative length.
Message Delivery: Delivering a message payload where the header table contains a malformed field matching the criteria above.

Impact Availability: High. A single malformed frame can reliably crash the client process, resulting in a persistent Denial of Service (DoS) if the client automatically reconnects and receives the same payload.

Severity

8.9 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rabbitmq/amqp091-go"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77412"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-681"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T17:04:29Z",
    "nvd_published_at": "2026-09-16T15:17:50Z",
    "severity": "HIGH"
  },
  "details": "**Summary**\nA vulnerability in the readField function allows a malicious or compromised AMQP server to trigger an unhandled runtime panic in the client application, leading to an immediate crash of the entire process.\n\n**Details**\nWhen parsing incoming AMQP frames, the `readField` function processes byte-array fields (type tag `\u0027x\u0027`) by reading a 32-bit big-endian integer to determine the length of the data payload.\n\n```go\n// read.go:253-263\ncase \u0027x\u0027:\n    var len int32\n    if err = binary.Read(r, binary.BigEndian, \u0026len); err != nil {\n        return nil, err\n    }\n    value := make([]byte, len)  // PANICS if len \u003c 0\n```\n\nIf a server transmits a length value of `0xFFFFFFFF`, it is interpreted by the client as a signed 32-bit integer with a value of `-1`. Passing a negative integer to Go\u0027s built-in make() function for slice allocation triggers an unrecoverable runtime panic (panic: len out of range).\n\nBecause the reader goroutine handles network I/O without an explicit recover() wrapper, this panic propagates up to the runtime root, abruptly terminating the host application.\n\n**Attack Vector / Exploitation Scenario**\nAn attacker capable of spoofing, compromising, or controlling an AMQP broker can exploit this flaw during two primary phases:\n\n1. Connection Establishment: Sending a malicious connection.start handshake frame containing server-properties with an \u0027x\u0027 type field assigned a negative length.\n2. Message Delivery: Delivering a message payload where the header table contains a malformed field matching the criteria above.\n\n**Impact**\nAvailability: High. A single malformed frame can reliably crash the client process, resulting in a persistent Denial of Service (DoS) if the client automatically reconnects and receives the same payload.",
  "id": "GHSA-4v58-74mf-rjx3",
  "modified": "2026-09-17T17:04:29Z",
  "published": "2026-09-17T17:04:29Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77412"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/pull/344"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rabbitmq/amqp091-go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client"
}

RHSA-2026:68290

Vulnerability from csaf_redhat - Published: 2026-09-16 15:39 - Updated: 2026-10-17 14:25

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Scope

9 vulnerabilities in this advisory, including CVE-2026-77412.

CVE-2026-77412

A flaw was found in RabbitMQ amqp091-go. A malicious or compromised broker can send a specially crafted AMQP (Advanced Message Queuing Protocol) message with a malformed field length. This can cause an integer overflow, leading to a runtime panic in the client process. Consequently, the client process terminates, resulting in a denial of service.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 3 products

https://access.redhat.com/errata/RHSA-2026:68290

Open the full advisory

RHSA-2026:77656

Vulnerability from csaf_redhat - Published: 2026-10-07 15:14 - Updated: 2026-10-17 14:25

Summary

Red Hat Security Advisory: Red Hat Quay 3.9.27

Severity

Important

Scope

15 vulnerabilities in this advisory, including CVE-2026-77412.

CVE-2026-77412

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 3 products Known not affected: 19 products

https://access.redhat.com/errata/RHSA-2026:77656

Open the full advisory

RHSA-2026:79366

Vulnerability from csaf_redhat - Published: 2026-10-08 15:58 - Updated: 2026-10-16 23:16

Summary

Red Hat Security Advisory: Red Hat Quay 3.10.27

Severity

Important

Scope

12 vulnerabilities in this advisory, including CVE-2026-77412.

CVE-2026-77412

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 3 products Known not affected: 19 products

https://access.redhat.com/errata/RHSA-2026:79366

Open the full advisory

RHSA-2026:79546

Vulnerability from csaf_redhat - Published: 2026-10-08 21:48 - Updated: 2026-10-17 14:25

Summary

Red Hat Security Advisory: Red Hat Quay 3.12.23

Severity

Important

Scope

14 vulnerabilities in this advisory, including CVE-2026-77412.

CVE-2026-77412

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 4 products Known not affected: 24 products

https://access.redhat.com/errata/RHSA-2026:79546

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-77412 (GCVE-0-2026-77412)

CLEANSTART-2026-JY06223 (CVE-2026-77412)

CLEANSTART-2026-PK85962 (CVE-2026-77412)

FKIE_CVE-2026-77412

GHSA-4V58-74MF-RJX3

RHSA-2026:68290

RHSA-2026:77656

RHSA-2026:79366

RHSA-2026:79546

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour