CVE-2026-77412
RabbitMQ amqp091-go client panics on a negative byte-array length from the broker
Technology
RabbitMQ
CVSS Score
8.9 / 10.0
Affected Versions
amqp091-go before 1.13.0
Upstream Fix
amqp091-go 1.13.0
Published
September 16, 2026
OSSeva Coverage
Fixed upstream
Description
readField reads the length of a byte-array table field into a signed int32 and passes it straight to make. A malicious or compromised broker can send 0xFFFFFFFF, which becomes -1 and causes a runtime panic that escapes the reader goroutine and terminates the client process, including while server properties are parsed at connection start.
Is your RabbitMQ deployment affected?
If you're running amqp091-go before 1.13.0, you need this patch. Book a discovery call to get covered.
Get a quote
Running RabbitMQ amqp091-go before 1.13.0?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?