CVE-2026-77412: RabbitMQ amqp091-go Client DOS Vulnerability

CVE-2026-77412 Overview

CVE-2026-77412 affects the RabbitMQ amqp091-go client library, a Go implementation of the AMQP 0.9.1 protocol. The readField function in read.go reads the length of an AMQP byte-array field into a signed int32 and passes that value directly to make when allocating the field buffer. A malicious or compromised broker can send a length value such as 0xFFFFFFFF, which decodes to -1 and triggers a len out of range runtime panic. The panic escapes the network reader goroutine and terminates the client process. Version 1.13.0 fixes the flaw by validating the field length before allocation.

Critical Impact
A hostile AMQP broker can crash any Go client using amqp091-go prior to 1.13.0, causing a client-side denial of service during connection handshake or message header parsing.

Affected Products

RabbitMQ amqp091-go Go client library versions prior to 1.13.0
Go applications that connect to untrusted or potentially compromised AMQP 0.9.1 brokers using this client
Downstream services embedding vulnerable versions of amqp091-go through Go module dependencies

Discovery Timeline

2026-09-16 - CVE-2026-77412 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-77412

Vulnerability Analysis

The vulnerability is a numeric truncation and sign-conversion issue classified under [CWE-681: Incorrect Conversion between Numeric Types]. The AMQP 0.9.1 wire protocol encodes byte-array field lengths as unsigned 32-bit integers. The amqp091-go client reads that length into a signed int32 variable, so any encoded length greater than 0x7FFFFFFF becomes a negative Go integer.

The negative length is then passed unchecked to Go's make([]byte, len) builtin. Go's runtime rejects negative slice lengths with a len out of range panic. Because the panic occurs inside the network reader goroutine and is not recovered, it propagates and terminates the entire client process.

The malformed field can appear in connection.start server properties during the initial handshake or inside message header tables during normal operation. This gives an attacker controlling the broker multiple opportunities to crash any connected client.

Root Cause

The root cause is the use of a signed int32 to hold a value that the protocol specifies as unsigned, combined with the absence of a bounds check before allocation. The reader trusts broker-supplied length prefixes without validating that they are non-negative or within reasonable size limits.

Attack Vector

Exploitation requires the client to connect to an attacker-controlled or compromised AMQP broker. No authentication is required on the client side, and no user interaction is needed. Once connected, the broker sends a crafted frame containing a byte-array field with a length of 0xFFFFFFFF, causing the client process to terminate.

// Patch from read.go - Safely handle negative x- field length. (#344)
if err = binary.Read(r, binary.BigEndian, &len); err != nil {
    return nil, err
}
if len < 0 {
    return nil, ErrSyntax
}

value := make([]byte, len)
if _, err = io.ReadFull(r, value); err != nil {
// Source: https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf

The patch adds an explicit negative-length check that returns ErrSyntax before the make call, preventing the runtime panic.

Detection Methods for CVE-2026-77412

Indicators of Compromise

Unexpected termination of Go processes linking amqp091-go with panic messages referencing runtime error: makeslice: len out of range
Repeated client reconnect loops against a single broker followed by immediate process exit
AMQP frames on the wire containing byte-array field length prefixes at or near 0xFFFFFFFF

Detection Strategies

Inventory Go binaries and container images that import github.com/rabbitmq/amqp091-go at versions prior to 1.13.0 using SBOM tooling or go list -m all
Correlate process crash telemetry with outbound AMQP connections on TCP/5672 and TCP/5671 to identify likely exploitation attempts
Deploy AMQP-aware network inspection to flag field-table length values that exceed a sane upper bound such as the maximum frame size

Monitoring Recommendations

Alert on abnormal restart rates of services that consume RabbitMQ queues, particularly when restarts coincide with broker connection events
Log and review the source addresses of AMQP brokers that clients connect to, and alert on connections to unapproved endpoints
Ingest client crash dumps into a central data lake and search for the makeslice panic signature

How to Mitigate CVE-2026-77412

Immediate Actions Required

Upgrade github.com/rabbitmq/amqp091-go to version 1.13.0 or later in all Go projects and rebuild affected binaries and container images
Restrict outbound AMQP connections so that clients only reach trusted, authenticated brokers under your control
Audit dependency graphs for transitive inclusion of vulnerable amqp091-go versions and update lockfiles accordingly

Patch Information

The fix is included in GitHub Release v1.13.0. The code change is documented in Pull Request #344 and the corresponding commit 669b42b. Full advisory details are available in GHSA-4v58-74mf-rjx3.

Workarounds

Terminate AMQP connections through a trusted, validating proxy that enforces sane upper bounds on field-table length prefixes
Use mutual TLS and strict broker allow-listing to reduce the risk of clients connecting to a hostile or spoofed broker
Wrap consumer goroutines with supervised restart logic so a client crash does not cascade into extended service downtime while patching proceeds

bash

# Update the module to the fixed version
go get github.com/rabbitmq/amqp091-go@v1.13.0
go mod tidy

# Verify the resolved version
go list -m github.com/rabbitmq/amqp091-go