CVE-2026-77406
RabbitMQ amqp091-go client wraps negative prefetch values into very large limits
Technology
RabbitMQ
CVSS Score
8.2 / 10.0
Affected Versions
amqp091-go before 1.13.0
Upstream Fix
amqp091-go 1.13.0
Published
September 16, 2026
OSSeva Coverage
Fixed upstream
Description
Channel.Qos casts negative prefetchCount and prefetchSize values to unsigned fields without validation, so -1 becomes 65535 or 4294967295. An application that lets untrusted input set these values can end up asking the broker for enough messages to exhaust client memory.
Is your RabbitMQ deployment affected?
If you're running amqp091-go before 1.13.0, you need this patch. Book a discovery call to get covered.
Get a quote
Running RabbitMQ amqp091-go before 1.13.0?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?