CVE-2026-77411

RabbitMQ's amqp091-go, the standard Go client library for the AMQP 0-9-1 messaging protocol, contains an improper error-handling flaw (CWE-754): before version 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared long-string length exceeds 0x7FFFFFFF, instead of returning ErrSyntax. A malicious or compromised broker can supply a table field with such an oversized longstr; readTable treats the failed read as successful and continues parsing from the wrong byte offset, desynchronizing the connection. Attacker-controlled trailing bytes are then misinterpreted as later table fields or protocol frames, disrupting connection integrity and availability — CVSS 4.0 scores this critical (9.5), though exploitation requires the client to be connected to a hostile broker. Any Go application built with amqp091-go prior to 1.13.0 is affected, particularly those connecting to third-party, multi-tenant, or otherwise not-fully-trusted AMQP endpoints. No public proof-of-concept is known, the flaw is not in CISA's KEV, and no exploitation has been reported.

What to do: Upgrade to amqp091-go 1.13.0 or later and rebuild all Go binaries that link the library; audit go.mod, vendored copies, and dependency trees for versions below 1.13.0. Until patched, restrict clients to brokers you fully control and treat connections to third-party or shared AMQP services as untrusted. Prioritize patching applications that talk to external or multi-tenant brokers, since broker compromise or malice is the prerequisite for exploitation.