CVE-2026-77410

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77410
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77410.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77410
Aliases
Downstream
Published
2026-09-16T14:39:08Z
Modified
2026-09-18T03:48:30Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator
Summary
RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation
Details

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header.Size value supplied by an AMQP content header without capping the allocation to the negotiated Connection.Config.FrameSize value. A malicious or compromised broker can send an extreme declared body size and cause the Go runtime to attempt a correspondingly large allocation before body data is received. The allocation can exhaust memory and terminate the client process. This issue is fixed in version 1.13.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-789"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77410.json"
}
References

Affected packages

Git / github.com/rabbitmq/amqp091-go

Affected ranges

Type
GIT
Repo
https://github.com/rabbitmq/amqp091-go
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
91b65fa0096a99a580cf51a31b24028ff1c60382
Fixed
d26d57e952cc61554ea9c54bd676c8f40ed0d84d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.13.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.2.0
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.3.4
v1.4.0
v1.5.0
v1.6.0
v1.6.1
v1.6.1-rc.1
v1.6.1-rc.2
v1.7.0
v1.8.0
v1.8.1
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77410.json"