CVE-2026-77410
RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation
Reported by github_m · Published September 16, 2026
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header.Size value supplied by an AMQP content header without capping the allocation to the negotiated Connection.Config.FrameSize value. A malicious or compromised broker can send an extreme declared body size and cause the Go runtime to attempt a correspondingly large allocation before body data is received. The allocation can exhaust memory and terminate the client process. This issue is fixed in version 1.13.0.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| rabbitmq | amqp091-go | < 1.13.0 |
| rabbitmq | amqp091-go | 0 |
| github.com | rabbitmq/amqp091-go | 0 |
Timeline
- Sep 16, 2026 Coalition ESS Score
- Sep 16, 2026 CVE Published
- Sep 17, 2026 CVE Updated
- Sep 17, 2026 EPSS Score (18 in total, the first dated here)
- Oct 30, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-77410
vulnetix vdb fixes CVE-2026-77410Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-77410/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-r9c8-gcjp-xfwh x_refsource_CONFIRM
- https://github.com/rabbitmq/amqp091-go/pull/346 x_refsource_MISC
- https://github.com/rabbitmq/amqp091-go/commit/91b65fa0096a99a580cf51a31b24028ff1c60382 x_refsource_MISC
- https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-77410 advisory
- https://github.com/advisories/GHSA-r9c8-gcjp-xfwh advisory