CVE-2026-77408

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77408
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77408.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77408
Aliases
Downstream
Published
2026-09-16T14:30:03Z
Modified
2026-09-18T03:48:30Z
Severity
  • 9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:L CVSS Calculator
Summary
RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow
Details

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-190"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77408.json"
}
References

Affected packages

Git / github.com/rabbitmq/amqp091-go

Affected ranges

Type
GIT
Repo
https://github.com/rabbitmq/amqp091-go
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6959423aa2784a1971e399175dfb2065dea0f3b0
Fixed
d26d57e952cc61554ea9c54bd676c8f40ed0d84d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.13.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.6.1-rc.1
v1.6.1-rc.2
v1.7.0
v1.8.0
v1.8.1
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77408.json"