CVE-2026-77411: RabbitMQ amqp091-go DOS Vulnerability

CVE-2026-77411 Overview

CVE-2026-77411 affects the RabbitMQ amqp091-go client, a Go implementation of the Advanced Message Queuing Protocol (AMQP) 0.9.1. Versions prior to 1.13.0 mishandle oversized longstr fields in the readLongstr function within read.go. When a declared AMQP longstr length exceeds 0x7FFFFFFF, the function returns an empty string and a nil error instead of ErrSyntax. This missing error signal causes readTable to continue parsing from an incorrect offset, allowing a malicious or compromised broker to desynchronize the AMQP parser and inject attacker-controlled bytes into subsequent fields or frames. The flaw disrupts connection integrity and availability for Go applications consuming AMQP from untrusted brokers.

Critical Impact

A malicious broker can desynchronize AMQP frame parsing in Go clients, causing attacker-controlled bytes to be interpreted as later protocol fields and compromising connection integrity and availability.

Affected Products

• RabbitMQ amqp091-go client library versions prior to 1.13.0
• Go applications that connect to AMQP 0.9.1 brokers using amqp091-go
• Downstream services and message consumers built on the vulnerable client

Discovery Timeline

• 2026-09-16 - CVE-2026-77411 published to the National Vulnerability Database
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-77411

Vulnerability Analysis

The vulnerability is an improper check for unusual or exceptional conditions [CWE-754] in the AMQP longstr parser. AMQP longstr fields carry a 32-bit unsigned length prefix followed by that many bytes of payload. The readLongstr function in read.go correctly rejects lengths greater than 0x7FFFFFFF, since Go slices cannot exceed max int32. However, the pre-patch code returns from the function without emitting an error and without consuming the declared payload bytes from the underlying reader.

The calling function readTable interprets a nil error as success and advances its parsing state as if the field were consumed. The unread bytes on the wire then become the input for the next field decode. This shifts the parser offset by an attacker-chosen amount.

Root Cause

The root cause is a missing error return on a bounds check. The function detects an invalid length but exits via a bare return statement, which yields the zero values "" and nil. The caller has no signal that parsing failed and no way to know the reader was not advanced past the malformed field. This violates the parser's implicit contract that a successful read consumes exactly the declared field length.

Attack Vector

Exploitation requires the Go client to connect to an attacker-controlled or compromised AMQP broker. The broker sends a table field containing a longstr whose declared length exceeds 0x7FFFFFFF. The client silently accepts the malformed field, then interprets the trailing bytes the attacker placed in the frame as later table entries or protocol frames. The attacker gains control over how downstream fields are parsed and can steer the connection into inconsistent states, malformed method frames, or termination.

// Patch from read.go - Return ErrSyntax when longstr length exceeds max int32
// slices can't be longer than max int32 value
if length > (^uint32(0) >> 1) {
-    return
+    return "", ErrSyntax
}

bytes := make([]byte, length)

Source: GitHub Commit 143c1ac

Detection Methods for CVE-2026-77411

Indicators of Compromise

• AMQP frames from a broker containing longstr length values greater than 0x7FFFFFFF (2147483647)
• Unexpected AMQP protocol errors, connection resets, or channel exceptions in Go services using amqp091-go below 1.13.0
• Malformed method or content frames logged by consumers shortly after connecting to a new or untrusted broker endpoint

Detection Strategies

• Inventory Go build manifests (go.mod, go.sum) across repositories and container images for github.com/rabbitmq/amqp091-go versions below v1.13.0
• Inspect AMQP traffic at TLS terminators or service meshes for oversized table field length prefixes on inbound broker-to-client frames
• Correlate AMQP client crash or reconnect telemetry with broker identity to identify suspicious brokers

Monitoring Recommendations

• Emit structured logs for every AMQP parse error and forward them to a centralized analytics platform for anomaly review
• Monitor connection churn and channel-close reason codes on AMQP client fleets
• Alert when Go services establish AMQP sessions with brokers outside the approved allowlist

How to Mitigate CVE-2026-77411

Immediate Actions Required

• Upgrade github.com/rabbitmq/amqp091-go to version 1.13.0 or later in all Go services and rebuild affected container images
• Audit AMQP client configurations and restrict connections to trusted, authenticated broker endpoints only
• Enforce TLS with certificate validation on all AMQP connections to prevent broker impersonation

Patch Information

The issue is fixed in amqp091-go v1.13.0. The patch modifies readLongstr in read.go to return ErrSyntax when the declared length exceeds 0x7FFFFFFF, ensuring readTable and other callers stop parsing on invalid input. Details are available in the GitHub Security Advisory GHSA-c5pq-fr2g-9jpf, the v1.13.0 release notes, and the pull request discussion.

Workarounds

• Restrict AMQP client connectivity to brokers under organizational control using network policies or service mesh authorization
• Terminate AMQP sessions immediately when clients log protocol parse errors and refuse automatic reconnection to the same broker
• Deploy mutual TLS between AMQP clients and brokers to prevent injection of a malicious broker into the connection path

# Update the vulnerable dependency in a Go module
go get github.com/rabbitmq/amqp091-go@v1.13.0
go mod tidy
go build ./...