CVE-2026-77409

RabbitMQ's amqp091-go, the widely used Go client for the AMQP 0-9-1 protocol, prior to version 1.13.0 synchronously forwards broker events — publisher confirmations, flow-control notices, consumer cancellations, and returned messages, including NotifyConfirm events and connection-block notifications — to application-supplied Go channels in Channel.dispatch, confirms.confirm, and Connection.dispatch0. If such a channel is unbuffered, full, or not drained promptly, the client's sole reader goroutine blocks on the send and stops processing incoming frames, acknowledgments, deliveries, and heartbeats. An attacker or compromised/misbehaving broker that can trigger bursts of these events can therefore stall connections, cause missed heartbeats, deadlocks, and disconnections — an availability-focused denial of service that can silently halt message processing (CVSS 4.0 rates availability impact as High). Any Go application embedding amqp091-go before 1.13.0 that passes unbuffered or under-drained notification channels to the library's Notify* APIs is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the issue is not listed in CISA KEV.

What to do: Upgrade github.com/rabbitmq/amqp091-go to version 1.13.0 or later and scan go.mod / dependency graphs for older versions. If upgrading is not immediately possible, audit all Notify* registrations (e.g., NotifyConfirm, NotifyReturn, NotifyFlow, NotifyCancel, connection block notifications) and ensure the supplied channels are adequately buffered and drained by dedicated goroutines that never block on send.