---
id: "CVE-2026-77406"
kind: "vulnerability"
aliases: ["CVE-2026-77406", "GHSA-rm6m-hrcw-jw33", "GO-2026-6502"]
title: "RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration in github.com/rabbitmq/amqp091-go"
severity: "high"
cvss: 8.2
epss: 0.00412
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/rabbitmq/amqp091-go", "fixed": ["1.13.0"], "affected": "< 1.13.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["amqp091-go", "go", "message-consumers", "package", "rabbitmq"]
not_affected_if: ["no-untrusted-qos-config", "prefetch-hardcoded", "version-1.13.0-or-later"]
published_at: "2026-09-16T15:17:49+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:44:10+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6502", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-77406", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77406", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration in github.com/rabbitmq/amqp091-go

A Go AMQP 0.9.1 client library for RabbitMQ accepts negative prefetch values in Channel.Qos, which wrap to very large unsigned numbers. An attacker who can influence those settings can make the broker flood the client with queued messages until its memory is exhausted.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/rabbitmq/amqp091-go affected < 1.13.0 fixed 1.13.0

## How to check

Run go list -m github.com/rabbitmq/amqp091-go in the project and check whether the version is below 1.13.0.
Search the code for calls to Channel.Qos or Qos( whose prefetch arguments come from config, env, or user input.

## Fix

Upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later.
Until then, make sure prefetchCount and prefetchSize are hard-coded or validated as non-negative.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6502
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-77406
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77406

## From the sources

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 or 4294967295 instead of being rejected. An application that permits untrusted configuration of these Qos values can unintentionally request extremely large prefetch limits, allowing a broker to deliver enough queued messages to exhaust client memory and disrupt processing. This issue is fixed in version 1.13.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_