Live › vulnerability › CVE-2026-77406
Go to dashboardA Go AMQP 0.9.1 client library for RabbitMQ accepts negative prefetch values in Channel.Qos, which wrap to very large unsigned numbers. An attacker who can influence those settings can make the broker flood the client with queued messages until its memory is exhausted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/rabbitmq/amqp091-go | go | < 1.13.0 | 1.13.0 |
1.13.01.13.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 or 4294967295 instead of being rejected. An application that permits untrusted configuration of these Qos values can unintentionally request extremely large prefetch limits, allowing a broker to deliver enough queued messages to exhaust client memory and disrupt processing. This issue is fixed in version 1.13.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-77406")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.