UBUNTU-CVE-2026-77412

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-77412
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77412.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-77412
Upstream
Published
2026-09-16T15:17:00Z
Modified
2026-10-28T20:15:22Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compromised broker can encode a value such as 0xFFFFFFFF, which becomes -1 and causes a len out of range runtime panic. The panic escapes the network reader goroutine and terminates the client process, including during connection.start server properties or message header table parsing. This issue is fixed in version 1.13.0.

References

Affected packages

Ubuntu:24.04:LTS / golang-github-rabbitmq-amqp091-go

Package

Name
golang-github-rabbitmq-amqp091-go
Purl
pkg:deb/ubuntu/golang-github-rabbitmq-amqp091-go?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.8.1-2
1.9.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "golang-github-rabbitmq-amqp091-go-dev",
            "binary_version": "1.9.0-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77412.json"

Ubuntu:26.10 / golang-github-rabbitmq-amqp091-go

Package

Name
golang-github-rabbitmq-amqp091-go
Purl
pkg:deb/ubuntu/golang-github-rabbitmq-amqp091-go?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.10.0-1
1.11.0-1
1.12.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "golang-github-rabbitmq-amqp091-go-dev",
            "binary_version": "1.12.0-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77412.json"

Ubuntu:26.04:LTS / golang-github-rabbitmq-amqp091-go

Package

Name
golang-github-rabbitmq-amqp091-go
Purl
pkg:deb/ubuntu/golang-github-rabbitmq-amqp091-go?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.10.0-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "golang-github-rabbitmq-amqp091-go-dev",
            "binary_version": "1.10.0-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-77412.json"