CVE-2026-77409
RabbitMQ amqp091-go client stalls when an application notification channel is not drained
Technology
RabbitMQ
CVSS Score
8.2 / 10.0
Affected Versions
amqp091-go before 1.13.0
Upstream Fix
amqp091-go 1.13.0
Published
September 16, 2026
OSSeva Coverage
Fixed upstream
Description
Publisher confirms, flow events, cancellations, returns and block notifications are sent synchronously to application-provided channels. If a listener channel is unbuffered, full or slow, the single reader goroutine blocks and stops handling frames, acknowledgements, deliveries and heartbeats, so a burst of broker events can stall or drop the connection.
Is your RabbitMQ deployment affected?
If you're running amqp091-go before 1.13.0, you need this patch. Book a discovery call to get covered.
Get a quote
Running RabbitMQ amqp091-go before 1.13.0?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?