Live › vulnerability › CVE-2026-77408
Go to dashboardThe amqp091-go Go AMQP client silently truncates shortstr message properties longer than 255 bytes, such as CorrelationId, ReplyTo, MessageId and UserId, without returning an error. An attacker who can supply oversized property values can corrupt message metadata, which can break request/reply correlation and routing.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/rabbitmq/amqp091-go | go | < 1.13.0 | 1.13.0 |
go list -m github.com/rabbitmq/amqp091-go (or grep amqp091-go go.mod) and check whether the version is below 1.13.0
Check whether the application passes user-controlled values into the listed message properties
Upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later
Also reject or validate property values longer than 255 bytes in application code until upgraded
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-77408")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.