{"id":"CVE-2026-77408","kind":"vulnerability","aliases":["CVE-2026-77408","GHSA-j497-x9hr-x34x","GO-2026-6498"],"related":[],"title":"RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow in github.com/rabbitmq/amqp091-go","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.","summary":"The amqp091-go Go AMQP client silently truncates shortstr message properties longer than 255 bytes, such as CorrelationId, ReplyTo, MessageId and UserId, without returning an error. An attacker who can supply oversized property values can corrupt message metadata, which can break request/reply correlation and routing.","severity":"critical","cvss":9.1,"epss":0.00524,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/rabbitmq/amqp091-go","fixed":["1.13.0"],"affected":"< 1.13.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["amqp","go","messaging","package","rabbitmq"],"not_affected_if":["no-user-controlled-message-properties","version-1.13.0-or-later"],"how_to_check":"go list -m github.com/rabbitmq/amqp091-go (or grep amqp091-go go.mod) and check whether the version is below 1.13.0\nCheck whether the application passes user-controlled values into the listed message properties","fix":"Upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later\nAlso reject or validate property values longer than 255 bytes in application code until upgraded","status":"open","published_at":"2026-09-16T15:17:49+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:43:52+00:00","updated_at":"2026-10-23T21:43:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:43:52Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later\nAlso reject or validate property values longer than 255 bytes in application code until upgraded","reach":"unknown","impact":"medium","summary":"The amqp091-go Go AMQP client silently truncates shortstr message properties longer than 255 bytes, such as CorrelationId, ReplyTo, MessageId and UserId, without returning an error. An attacker who can supply oversized property values can corrupt message metadata, which can break request/reply correlation and routing.","category":"package","who_cares":["go","rabbitmq","amqp","messaging"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Message metadata silently truncated, breaking correlation and routing","analyst_note":"Sources conflict: govuln/NVD list CVSS 9.1 critical, but the description describes silent metadata truncation. Check the NVD vector at https://nvd.nist.gov/vuln/detail/CVE-2026-77408 to see what the score assumes about reachability.","how_to_check":"go list -m github.com/rabbitmq/amqp091-go (or grep amqp091-go go.mod) and check whether the version is below 1.13.0\nCheck whether the application passes user-controlled values into the listed message properties","needs_analyst":true,"not_affected_if":["version-1.13.0-or-later","no-user-controlled-message-properties"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000901,"input_tokens":3079,"output_tokens":1186,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':20A,28A,31A '-6498':29A '-77408':21A,32A '/rabbitmq/amqp091-go':18A,35A '0.9.1':95C '1.13.0':99C,179C '255':55B,122C 'accept':127C 'amqp':36B,46B,94C,110C 'amqp091':3A,43B,89C 'amqp091-go':2A,42B,88C 'appid':135C 'applic':125C 'attack':69B 'break':82B,162C 'byte':56B,107C,123C 'cast':105C 'client':47B,96C 'contentencod':137C 'contenttyp':136C 'correl':84B,166C 'correlationid':59B,130C 'corrupt':10A,77B,160C 'cve':19A,30A 'data':6A 'downstream':170C 'error':67B,155C 'expir':133C 'first':117C 'fix':176C 'function':102C 'ghsa':23A 'ghsa-j497-x9hr-x34x':22A 'github.com':17A,34A 'github.com/rabbitmq/amqp091-go':16A,33A 'go':4A,27A,37B,44B,45B,90C,93C 'integ':13A 'issu':174C 'j497':24A 'length':108C,146C 'longer':53B,120C 'messag':38B,51B,78B,171C 'messageid':61B,132C 'metadata':79B,159C 'overflow':14A 'overs':73B,129C 'packag':39B 'prefix':151C 'prior':97C 'process':172C 'properti':52B,74B,112C 'rabbitmq':1A,40B,87C 'reject':118C 'repli':165C 'replyto':60B,131C 'report':153C 'request':163C 'request/reply':83B 'result':157C 'return':65B 'rout':86B,167C 'serial':143C 'shortstr':12A,50B,111C 'silent':5A,48B,158C 'state':9A 'suppli':72B 'therefor':142C 'trace':168C 'truncat':7A,49B,150C 'type':139C 'uint8':115C 'userid':63B,134C 'valu':75B,113C,119C,140C 'version':178C 'via':11A 'without':64B,116C 'wrap':145C 'write.go':104C 'writeshortstr':101C 'x34x':26A 'x9hr':25A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-16T15:17:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6498","url":"https://pkg.go.dev/vuln/GO-2026-6498","severity":null,"published_at":"2026-10-01T20:23:56+00:00","modified_at":"2026-10-01T20:23:56+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-77408","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77408","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-77408","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77408","severity":null,"published_at":"2026-09-16T15:17:49+00:00","modified_at":"2026-09-23T18:19:19+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}