CVE-2026-77411 in amqp091-go
Summary
by MITRE • 09/16/2026
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning ErrSyntax. The function leaves the declared field bytes unread, while readTable treats the operation as successful and continues parsing from the wrong offset. A malicious or compromised broker can provide an oversized longstr in a table field and desynchronize subsequent AMQP parsing, causing attacker-controlled trailing bytes to be interpreted as later fields or frames and disrupting connection integrity and availability. This issue is fixed in version 1.13.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The RabbitMQ amqp091-go library serves as a critical client implementation for the AMQP 0.9.1 protocol, facilitating communication between Go applications and message brokers. A significant vulnerability exists within this library prior to version 1.13.0, specifically located in the readLongstr function found in the read.go source file. This flaw stems from an improper handling of oversized string lengths declared within AMQP frames. According to the AMQP specification, a longstr field includes a four-byte unsigned integer indicating its length. The vulnerability arises when this declared length exceeds 0x7FFFFFFF, which is effectively the maximum value for a signed 32-bit integer in many contexts or represents an anomalous size that should trigger a protocol error rather than being processed as valid data.
In the affected versions of the library, instead of returning the appropriate ErrSyntax error to signal a malformed frame, readLongstr incorrectly returns an empty string along with a nil error value. This behavior indicates success to the calling function even though no actual payload was retrieved from the network stream. Crucially, the implementation fails to consume or skip over the declared field bytes that correspond to this oversized length declaration. By leaving these bytes unread in the input buffer, the internal state of the parser becomes desynchronized relative to the actual byte sequence received from the broker. This creates a discrepancy between where the parser believes it is reading and where data actually exists on the wire.
The operational impact of this desynchronization is severe because subsequent parsing operations rely on accurate offset tracking within the AMQP frame structure. Specifically, the readTable function, which parses complex table fields often used for message properties or arguments, treats the previous operation as successful due to the nil error return. Consequently, it proceeds to parse data starting from an incorrect byte offset. This misalignment allows a malicious or compromised broker to inject crafted oversized longstr values into frame headers. By doing so, the attacker can shift the parsing window such that subsequent legitimate bytes are interpreted incorrectly. The trailing bytes of the oversized field and following frames may be reinterpreted as different AMQP fields or control structures, leading to unpredictable behavior within the client application.
This vulnerability directly impacts connection integrity and service availability by disrupting the standard flow of message processing. An attacker exploiting this flaw could cause the client to misinterpret protocol commands, potentially leading to crashes, data corruption, or denial of service conditions where valid messages are dropped or processed incorrectly. The ability to desynchronize parsing effectively allows for a form of injection attack at the protocol level, undermining the reliability guarantees provided by AMQP. This aligns with CWE-20 Improper Input Validation, as the library fails to validate that input data conforms to expected structural constraints before processing it further. Furthermore, this scenario reflects aspects of ATT&CK technique T1598 Phishing for Information or potentially T1496 Resource Hijacking if exploited in a broader context of resource exhaustion through malformed frames, though primarily it represents a protocol-level integrity failure akin to CWE-20 and CWE-367 Time-of-check Time-of-use issues related to state consistency.
To mitigate this risk, organizations utilizing the RabbitMQ amqp091-go library must ensure they upgrade to version 1.13.0 or later immediately. This release corrects the logic in readLongstr to properly detect oversized length declarations and return a syntax error instead of proceeding with invalid data consumption. Additionally, developers should implement robust input validation at application boundaries where AMQP frames are constructed or processed, ensuring that any external inputs adhere strictly to protocol specifications. Monitoring for unusual disconnections or parsing errors in logs can also serve as an indicator of potential exploitation attempts against unpatched systems. Regular updates and adherence to vendor security advisories remain the primary defense against such implementation flaws in widely used messaging libraries.