CVE-2026-77406

The RabbitMQ amqp091-go library (the official Go AMQP 0.9.1 client) fails to validate values passed to Channel.Qos before casting signed integers to unsigned uint16/uint32 fields, a signed-to-unsigned conversion error (CWE-195). Versions prior to 1.13.0 wrap negative values such as -1 into extremely large prefetch limits (65535 or 4294967295) instead of rejecting them. Exploitation requires an application that lets untrusted input configure these Qos values; an attacker who can set a negative prefetchCount or prefetchSize causes the client to accept massive prefetch limits, letting the broker flood it with queued messages until client memory is exhausted and message processing is disrupted (denial of service, with limited impact on downstream systems). Any Go application embedding amqp091-go before 1.13.0 is vulnerable in principle, but only those exposing Qos settings to untrusted control are realistically exploitable, which the CVSS attack-requirements metric reflects. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known.

What to do: Upgrade github.com/rabbitmq/amqp091-go to version 1.13.0 or later, which restores Qos validation. In the meantime, audit your dependency tree (go.mod) for the library and reject or clamp negative prefetchCount/prefetchSize values at the application layer, especially where Qos settings come from user- or API-supplied configuration. Treat this primarily as a client-side denial-of-service risk; brokers and message data are not directly compromised.