VDB
CVE-2026-77406
CVE-2026-77406
PUBLISHED
CVSS 8.2 HIGH
Reported by GitHub_M · Published September 16, 2026
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 or 4294967295 instead of being rejected. An application that permits untrusted configuration of these Qos values can unintentionally request extremely large prefetch limits, allowing a broker to deliver enough queued messages to exhaust client memory and disrupt processing. This issue is fixed in version 1.13.0.
Risk Scores
CVSS 4.0
8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| rabbitmq | amqp091-go | < 1.13.0 |
| github.com | rabbitmq/amqp091-go | 0 |
| rabbitmq | amqp091-go | < 1.13.0, < 1.13.0 |
Timeline
- Sep 16, 2026 Coalition ESS Score
- Sep 16, 2026 CVE Published
- Sep 17, 2026 CVE Updated
- Sep 17, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 18, 2026 Security Advisory
- Sep 24, 2026 EPSS Score
- Sep 26, 2026 EPSS Score
- Sep 30, 2026 EPSS Score
- Oct 2, 2026 EPSS Score
- Oct 6, 2026 EPSS Score
- Oct 8, 2026 EPSS Score
References
- https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-rm6m-hrcw-jw33 x_refsource_CONFIRM
- https://github.com/rabbitmq/amqp091-go/pull/351 x_refsource_MISC
- https://github.com/rabbitmq/amqp091-go/commit/3b879e1d1d25b544e26b3bc3d7db3213203c0f3b x_refsource_MISC
- https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-77406 advisory
- https://github.com/advisories/GHSA-rm6m-hrcw-jw33 advisory