CVE-2026-77412

RabbitMQ's amqp091-go library, the standard Go AMQP 0.9.1 client, prior to version 1.13.0 reads the length of an AMQP byte-array field (type tag 'x') in readField (read.go) into a signed int32 and passes it directly to make() when allocating the field buffer. A malicious or compromised broker can encode a length of 0xFFFFFFFF, which is interpreted as -1 and triggers a 'len out of range' runtime panic. The panic escapes the network reader goroutine and terminates the entire client process, and can be triggered during parsing of connection.start server properties or message header tables, i.e., essentially any interaction with a hostile broker. An attacker who controls or compromises the broker gains denial of service against every Go client connecting to it, with no confidentiality or integrity impact indicated by the CVSS vector (VA:H, VC:N, VI:N). Any Go application using amqp091-go before 1.13.0 is affected; no public PoC or known exploitation exists and the issue is not in CISA KEV.

What to do: Upgrade amqp091-go to version 1.13.0 or later (e.g., 'go get github.com/rabbitmq/[email protected]') and audit go.mod / dependency graphs for vulnerable versions. Until patched, restrict clients to trusted brokers, lock down broker access and credentials (the flaw requires a malicious or compromised broker), and monitor for unexplained client process restarts/crashes.