CVE-2026-77408: RabbitMQ amqp091-go Metadata Corruption

CVE-2026-77408 Overview

CVE-2026-77408 is an integer truncation vulnerability [CWE-190] in the RabbitMQ amqp091-go client library, a Go implementation of the AMQP 0.9.1 protocol. The flaw resides in the writeShortstr function within write.go. The function casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application accepting an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value serializes a wrapped length and only a truncated prefix while reporting no error. Version 1.13.0 fixes the issue.

Critical Impact

Silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing across AMQP-based messaging pipelines.

Affected Products

• RabbitMQ amqp091-go client library versions prior to 1.13.0
• Go applications consuming the amqp091-go package for AMQP 0.9.1 communication
• Downstream services relying on affected AMQP shortstr property values for routing or correlation

Discovery Timeline

• 2026-09-16 - CVE-2026-77408 published to NVD
• 2026-09-16 - Last updated in NVD database
• Patch released - amqp091-go v1.13.0 published on GitHub with the fix

Technical Details for CVE-2026-77408

Vulnerability Analysis

The AMQP 0.9.1 protocol defines a shortstr type as a length-prefixed string with a single-byte length field, capped at 255 bytes. The amqp091-go client encodes several message properties as shortstr values. When a caller supplies a string longer than 255 bytes, the library truncates the length via a uint8 conversion but writes the full byte slice's original length modulo 256 into the wire format. The frame remains well-formed from the encoder's perspective, so no error is returned to the application.

Consumers reading the message observe only the truncated prefix. This corrupts identifiers used for reply correlation, distributed tracing spans, and content-type dispatching. Producers cannot detect the loss because the send path succeeds normally.

Root Cause

The root cause is a numeric truncation error [CWE-190]. The writeShortstr function converted len(b) directly to uint8 without validating that the input fit within the protocol's 255-byte limit.

Attack Vector

An attacker who controls any input feeding an affected shortstr property can inject an oversized value to force silent truncation. In multi-tenant messaging architectures, this enables cross-context message misrouting, reply-to hijacking against downstream consumers, or bypass of correlation-based access decisions. The attack requires only that an application accept and forward untrusted strings into AMQP metadata fields.

// Security patch in write.go - amqp091-go v1.13.0
func writeShortstr(w io.Writer, s string) (err error) {
	b := []byte(s)
	if len(b) > 255 {
		return fmt.Errorf("amqp: shortstr %q exceeds 255 bytes", s)
	}

	length := uint8(len(b))

Source: GitHub Commit 6959423

Detection Methods for CVE-2026-77408

Indicators of Compromise

• AMQP messages where CorrelationId, MessageId, or ReplyTo values differ between producer logs and consumer logs
• Unmatched reply-to routing failures or orphaned RPC responses in RabbitMQ traffic
• Application logs showing successful publishes but downstream consumers reporting malformed or truncated metadata

Detection Strategies

• Audit Go module manifests (go.mod, go.sum) for github.com/rabbitmq/amqp091-go versions below v1.13.0
• Add producer-side length validation on all shortstr property values to log any input exceeding 255 bytes
• Correlate producer and consumer telemetry on message identifiers to detect silent truncation events

Monitoring Recommendations

• Instrument AMQP publish paths to emit metrics when property values approach or exceed the 255-byte shortstr boundary
• Alert on RabbitMQ dead-letter queue growth tied to routing key or reply-to mismatches
• Track distributed tracing spans for broken parent-child relationships caused by truncated correlation IDs

How to Mitigate CVE-2026-77408

Immediate Actions Required

• Upgrade github.com/rabbitmq/amqp091-go to version v1.13.0 or later across all Go services
• Rebuild and redeploy applications, container images, and CI pipelines that vendor the affected library
• Review upstream inputs feeding AMQP message properties and enforce length validation before publishing

Patch Information

The fix is available in amqp091-go release v1.13.0. The change is tracked in Pull Request #354 and GHSA-j497-x9hr-x34x. After the patch, writeShortstr returns an explicit error instead of truncating oversized values.

Workarounds

• Validate that all shortstr property values are 255 bytes or fewer before calling Publish or PublishWithContext
• Wrap the AMQP publish path with middleware that rejects oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, and Type fields
• Move large identifier payloads into message headers (longstr) or the message body rather than shortstr properties

# Update the vulnerable dependency to the patched release
go get github.com/rabbitmq/amqp091-go@v1.13.0
go mod tidy
go build ./...