External risk intelligence

RabbitMQ amqp091-go Integer Overflow Leads to Metadata Corruption

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-77408

This is a Go client library, not a standalone service or network appliance. It is integrated into application code as a dependency. Its exposure depends entirely on how an individual application utilizes it to handle data, making it fundamentally developer-integrated rather than a directly internet-facing service or component with its own public-facing network presence.

Integer Overflow

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in a Go client library for message queuing systems that could lead to silent corruption of message metadata. This could impact request and reply correlations, routing, and downstream message processing, potentially causing application disruptions.

Message metadata can be silently corrupted.
Fixes potential issues with message routing and processing.
Confirm relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending specially crafted messages to an application using the affected library. The library, when processing message properties like IDs or content types, incorrectly handles lengths exceeding 255 bytes. This leads to corrupted metadata, which can disrupt communication and message handling by the application.

Network access to the application is sufficient.
Sending oversized message metadata triggers corruption.
Risk includes broken message routing and processing.

Live Threat

Current exploitation, exposure, and threat context

When an application accepts overly long property values in AMQP messages, such as `CorrelationId` or `MessageId`, a silent metadata corruption can occur. This corruption may impact request and reply correlation, routing, tracing, and downstream message processing without raising an error.

Message metadata.
Oversized property values are accepted.
Breaks message correlation and processing.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the RabbitMQ Go AMQP client impacts applications that rely on it for message handling, potentially causing silent data corruption and breaking request/reply correlation, routing, and tracing. Application owners, in conjunction with platform or infrastructure teams, should prioritize identifying all instances of this client library within their codebase. Once located, assess the criticality and exposure of affected services, and coordinate with the development team to plan for remediation, likely involving updating the library dependency during a scheduled maintenance window.

Application owners must manage the issue.
Verify usage and exposure of the client.
Update the dependency and test thoroughly.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the RabbitMQ amqp091-go library?

It is a software library written in the Go programming language used by developers to enable their applications to communicate with RabbitMQ message brokers. It follows the AMQP 0.9.1 protocol, which is a standard way for distributed systems to send and receive messages reliably. You will find this library embedded directly within Go applications that require message queuing features for tasks like background processing or service-to-service communication.

What is the vulnerability in CVE-2026-77408?

This vulnerability is an integer overflow (CWE-190). When the library processes certain message properties—such as a CorrelationId or UserID—it tries to fit a potentially long text string into a limited numerical container that can only handle 255 bytes. Instead of rejecting strings that are too long, the code silently truncates them. This causes the message metadata to be malformed, which can scramble data and break how applications route or track their messages.

How is this metadata corruption triggered?

An attacker triggers this by sending a message to an application containing one of the affected properties—like a MessageId or ContentType—that exceeds 255 bytes in length. The bug is specifically tied to how the library serializes these specific fields during the network transmission process. Simply sending a message of a normal, expected length will not trigger this behavior, as the flaw specifically requires the length to exceed the protocol's implicit 255-byte limit.

Do I need to worry about this if my app is internal?

Yes, you should still evaluate it. While Halo Surface Signal notes that this is a developer-integrated library rather than a standalone network service, its risk depends on how your application handles incoming data. If your service processes messages from untrusted or external sources, those messages can be used as a vector. Even for internal-only services, you must consider whether any upstream component could inadvertently pass an oversized, attacker-controlled value through your system.

How do I fix CVE-2026-77408 in my software?

The primary response is to update your application's dependency. Developers should identify all projects utilizing the amqp091-go library and update to version 1.13.0 or later, where this truncation behavior has been corrected. Because this change affects how message metadata is handled, it is important to perform testing after the update to ensure that your message correlation, routing, and downstream processing logic continues to function as expected.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.