CVE-2026-77408

RabbitMQ's amqp091-go Go client library, prior to version 1.13.0, contains an integer overflow (CWE-190) in the writeShortstr function in write.go, which casts the byte length of AMQP 'shortstr' property values to uint8 without rejecting values longer than 255 bytes. If an application allows an oversized value to reach any shortstr field — CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type, frequently data originating from user or upstream input — the length wraps and only a truncated prefix is serialized, with no error reported. An attacker who can influence these fields can therefore silently corrupt message metadata, breaking request/reply correlation, routing, tracing, and downstream message processing; CVSS 4.0 rates the confidentiality impact low but message integrity and availability impact high. Any Go application or service embedding amqp091-go before 1.13.0 to communicate with RabbitMQ is affected regardless of broker version, since the flaw is in the client-side serializer. No exploitation has been reported, no public proof-of-concept is known, and the issue is not listed in CISA's KEV catalog.

What to do: Upgrade to amqp091-go v1.13.0 or later and rebuild and redeploy every Go service that embeds the library (patching the RabbitMQ broker alone does not fix this). As an interim mitigation, validate before publishing that the byte length of CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, and Type values never exceeds 255 bytes, especially when these fields are derived from user or third-party input. Also review Go-based consumers and request/reply flows for unexplained correlation or routing failures, which would indicate past silent truncation.