RabbitMQ amqp091-go up to 1.12.x AMQP Parser read.go readLongstr input validation

Summaryinfo

A vulnerability classified as problematic was found in RabbitMQ amqp091-go up to 1.12.x. This impacts the function readLongstr of the file read.go of the component AMQP Parser. Such manipulation leads to input validation. This vulnerability is documented as CVE-2026-77411. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in RabbitMQ amqp091-go up to 1.12.x and classified as problematic. Affected by this issue is the function readLongstr of the file read.go of the component AMQP Parser. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is integrity, and availability. CVE summarizes:

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning ErrSyntax. The function leaves the declared field bytes unread, while readTable treats the operation as successful and continues parsing from the wrong offset. A malicious or compromised broker can provide an oversized longstr in a table field and desynchronize subsequent AMQP parsing, causing attacker-controlled trailing bytes to be interpreted as later fields or frames and disrupting connection integrity and availability. This issue is fixed in version 1.13.0.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-77411 since 08/20/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit.

Upgrading to version 1.13.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-80821). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• RabbitMQ

Name

• amqp091-go

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12

Website

• Product: https://github.com/rabbitmq/amqp091-go/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion