CVE-2026-77408 in amqp091-go
Summary
by MITRE • 09/17/2026
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The RabbitMQ amqp091-go library serves as a Go implementation of the AMQP 0.9.1 protocol specification, facilitating communication between applications and RabbitMQ brokers. A critical vulnerability exists within this client prior to version 1.13.0, specifically located in the writeShortstr function found in the write.go source file. This function is responsible for serializing short string properties defined by the AMQP standard, which include metadata fields such as CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, and Type. The core technical flaw stems from an improper handling of data length validation during the serialization process. Specifically, the function casts the byte length of these property values directly to a uint8 type without first verifying that the input string does not exceed the maximum allowed size for AMQP short strings, which is 255 bytes.
This lack of boundary checking leads to integer truncation when longer strings are processed. Because a uint8 can only represent values from zero to two hundred fifty-five, any byte length exceeding this limit wraps around or gets truncated during the cast operation. Consequently, the library serializes only a wrapped length and a truncated prefix of the original string value into the message frame. Crucially, this truncation occurs silently without raising an error or warning to the application developer. This behavior violates fundamental principles of secure coding by failing to enforce input constraints before processing data for network transmission. The vulnerability is classified under CWE-190: Integer Overflow or Wraparound and CWE-20: Improper Input Validation, as it involves both a type conversion issue and a failure to validate the size of incoming data against expected limits.
The operational impact of this silent metadata corruption can be severe for distributed systems relying on precise message routing and correlation. Many AMQP-based architectures depend heavily on fields like CorrelationId and ReplyTo to match requests with their corresponding responses, particularly in asynchronous communication patterns or RPC-style interactions over queues. When these identifiers are truncated due to the vulnerability, the receiving application may fail to correlate incoming messages with outgoing requests, leading to broken workflows and lost context. Furthermore, routing mechanisms that rely on specific header values for message distribution can misdirect traffic, causing delays or delivery failures. In environments utilizing distributed tracing systems like OpenTelemetry or Jaeger, truncated trace identifiers disrupt observability efforts, making it difficult to diagnose latency issues or track transaction flows across microservices. Downstream processing logic that expects complete metadata may also encounter unexpected errors or undefined behavior when parsing these malformed frames.
To mitigate this risk, organizations using the amqp091-go library must upgrade immediately to version 1.13.0 or later, where the writeShortstr function has been patched to reject strings exceeding the two hundred fifty-five byte limit before serialization begins. For applications that cannot yet update their dependencies, a temporary mitigation involves implementing strict input validation at the application layer prior to passing string properties to the AMQP client library. Developers should ensure that all metadata fields are checked for length constraints and truncated or rejected explicitly if they exceed safe limits, thereby preventing the silent corruption from occurring in transit. Additionally, monitoring logs for unusual message routing patterns or correlation failures can help identify instances where this vulnerability may have been exploited or caused operational issues. This issue highlights the importance of rigorous input validation in protocol implementations to maintain data integrity and system reliability in messaging infrastructure aligned with MITRE ATT&CK techniques related to command and control evasion through malformed payloads, although primarily it represents a reliability and integrity concern rather than an exploitation vector for remote code execution.