---
id: CVE-2026-77408
title: RabbitMQ amqp091-go is a Go AMQP 0.9.1 client
summary: >-
  RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the
  writeShortstr function in write.go casts the byte length of AMQP shortstr
  property values to uint8 without first rejecting values longer than 255 bytes.
  An application t…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:L'
cwe:
  - CWE-190
vendor: rabbitmq
product: amqp091-go
affected:
  - amqp091-go < 1.13.0
patched:
  - github.com/rabbitmq/amqp091-go 1.13.0
published: '2026-09-16'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:19:19.803'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77408'
references:
  - url: >-
      https://github.com/rabbitmq/amqp091-go/commit/6959423aa2784a1971e399175dfb2065dea0f3b0
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/amqp091-go/pull/354'
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-j497-x9hr-x34x
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77408'
  - url: 'https://github.com/advisories/GHSA-j497-x9hr-x34x'
  - url: 'https://github.com/rabbitmq/amqp091-go'
tags:
  - nvd
  - cve.org
  - ghsa
  - go
  - osv
epss: 0.00411
epssPercentile: 0.35104
aliases:
  - GHSA-j497-x9hr-x34x
ecosystem: go
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-16T15:01:12.890594Z'
cvssSource: cna
ingestedAt: '2026-09-16T14:57:28.052Z'
---

## Overview

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-77408)

Affected packages:

- `github.com/rabbitmq/amqp091-go < 1.13.0`

Patched in:

- `github.com/rabbitmq/amqp091-go 1.13.0`

Source: https://github.com/advisories/GHSA-j497-x9hr-x34x