amqp091-go CVE-2026-77412

Requires the victim application to establish an AMQP 0.9.1 connection to a broker that the attacker controls, has compromised, or can impersonate via MITM - the malicious length value is delivered from the broker side during connection.start server-properties parsing or when parsing a message header field table. Limiting factors: the attacker must be on the server/broker side of the connection (not an unauthenticated internet client hitting a listening port), the affected client must run amqp091-go prior to 1.13.0, and the impact is confined to crashing the client process (availability), with no data disclosure or code execution. Clients that only ever connect to trusted, controlled brokers face substantially reduced practical risk.

This is an availability-only denial-of-service in the official Go RabbitMQ client (amqp091-go), driven by a CWE-681 signed/unsigned conversion bug: a byte-array length field is read into a signed int32 and passed to make(), so a broker-supplied 0xFFFFFFFF becomes -1 and triggers a 'len out of range' panic that kills the client process. The vendor CVSS 4.0 score of 8.9 is high, but the signals collectively temper real-world urgency: the vector encodes AT:P (attack requirements - a malicious or compromised broker is needed), impact is limited to availability (VA:H/SA:H; VC:N/VI:N), and CISA SSVC rates Exploitation as 'none' with only 'partial' technical impact. Automatable:yes reflects that once a client connects to a hostile broker the crash is trivially reproducible (the patch ships exact trigger bytes 0xFF FF FF FF and 0x80 00 00 00). No EPSS score, no KEV listing, and no public exploit are present. The core caveat for defenders: this is NOT remote-unauthenticated-against-a-listening-service - it requires the victim to connect to an attacker-controlled/compromised AMQP broker (or a MITM able to impersonate one), which is why raw CVSS overstates exposure relative to the practical precondition. Real priority is moderate: easy to trigger but only for clients pointed at untrusted brokers, and impact is a crash rather than data compromise or code execution.

An attacker who controls or has compromised an AMQP broker (or can MITM the AMQP connection) sends a crafted field table - for example in the connection.start server-properties or a message header table - encoding an 'x' byte-array with length 0xFFFFFFFF. When the Go client parses it, the length becomes int32(-1), make() panics, and the panic escapes the network reader goroutine and terminates the entire client process. No public weaponized exploit exists, though the fixing PR includes the exact trigger byte sequences as test vectors.