---
id: "CVE-2026-77408"
kind: "vulnerability"
aliases: ["CVE-2026-77408", "GHSA-j497-x9hr-x34x", "GO-2026-6498"]
title: "RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow in github.com/rabbitmq/amqp091-go"
severity: "critical"
cvss: 9.1
epss: 0.00524
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/rabbitmq/amqp091-go", "fixed": ["1.13.0"], "affected": "< 1.13.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["amqp", "go", "messaging", "package", "rabbitmq"]
not_affected_if: ["no-user-controlled-message-properties", "version-1.13.0-or-later"]
published_at: "2026-09-16T15:17:49+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:43:52+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6498", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-77408", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77408", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow in github.com/rabbitmq/amqp091-go

The amqp091-go Go AMQP client silently truncates shortstr message properties longer than 255 bytes, such as CorrelationId, ReplyTo, MessageId and UserId, without returning an error. An attacker who can supply oversized property values can corrupt message metadata, which can break request/reply correlation and routing.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/rabbitmq/amqp091-go affected < 1.13.0 fixed 1.13.0

## How to check

go list -m github.com/rabbitmq/amqp091-go (or grep amqp091-go go.mod) and check whether the version is below 1.13.0
Check whether the application passes user-controlled values into the listed message properties

## Fix

Upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later
Also reject or validate property values longer than 255 bytes in application code until upgraded

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6498
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-77408
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77408

## From the sources

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_