EUVD-2026-80791
GHSA-j497-x9hr-x34x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply oversized (>255 byte) property value
-
DeliveryApp sets it as AMQP shortstr
-
ExploitwriteShortstr truncates length to uint8
-
ExecutionWrapped length + truncated prefix serialized silently
-
ImpactCorrupted metadata breaks correlation/routing downstream
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an application built on amqp091-go prior to 1.13.0 that accepts and assigns a value longer than 255 bytes into one of the AMQP shortstr message properties: CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type. The oversized value must originate from an attacker-influenced or untrusted source for this to be an actual security exposure; applications that only ever set short, trusted, fixed-length property values are not practically affected. Limiting factors: the impact is silent data corruption (broken correlation/routing/tracing/downstream processing) rather than code execution, crash, or disclosure; there is no direct network trigger against the library itself - the application must be the one to serialize the oversized property. |
| Impact | This is a data-integrity flaw in the official RabbitMQ Go AMQP 0.9.1 client (rabbitmq/amqp091-go), not a memory-safety or code-execution issue: writeShortstr casts a string length to uint8 without rejecting values over 255 bytes, so an oversized AMQP shortstr property (CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type) is silently truncated and the length prefix wraps, with no error returned. The published CVSS 4.0 vector (9.1, VC:L/VI:H/VA:H/SI:H) appears materially over-scored: the described impact is silent metadata corruption affecting correlation, routing, and tracing (an integrity concern), with no confidentiality exposure and only indirect, downstream availability effects - VA:H is not supported by the description, which never claims a crash or service outage. There is no EPSS score, no CISA KEV listing, and no public exploit code identified; exploitation status is therefore 'no public exploit identified at time of analysis.' Realistically this is a moderate-severity correctness/integrity bug that matters most for applications that forward untrusted or user-controlled data into AMQP message properties, rather than a high-urgency, widely-weaponizable vulnerability. The gap between the 9.1 label and the actual integrity-only impact should be reconciled against the vendor advisory (GHSA-j497-x9hr-x34x) before prioritization. |
| Exploit ScenarioDerived | An application using amqp091-go copies an attacker-influenced value (e.g. an HTTP-supplied correlation identifier or user ID) longer than 255 bytes into an AMQP message property and publishes it; the client silently truncates the value and wraps the length prefix while returning no error. Consumers then see corrupted metadata, breaking request/reply correlation, routing keys, or tracing, and potentially causing messages to be mis-processed or dropped downstream. No public proof-of-concept exists, but the condition is trivially reproducible (a 256-byte string) as shown by the fix's regression test. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Silent AMQP 0.9.1 metadata corruption in the RabbitMQ amqp091-go Go client library prior to 1.13.0 lets an application that assigns an oversized value to any shortstr message property (CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type) serialize a wrapped uint8 length prefix alongside only a truncated value while reporting no error. The result is broken request/reply correlation, routing, tracing, and downstream message processing rather than code execution or disclosure; the flaw requires attacker-influenced data to reach a shortstr property, so applications that only set short, trusted, fixed-length values are not practically exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and version 1.13.0 contains the vendor fix (CVSS 4.0 base 9.1; our independent assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L, reflecting no privileges required but a high attack-complexity precondition).
RemediationAI
Vendor-released patch: upgrade the rabbitmq/amqp091-go module dependency to 1.13.0 (https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0, fixing PR #354 / commit 6959423aa2784a1971e399175dfb2065dea0f3b0); because this is a library, the fix must be pulled into every consuming application via go.mod and the resulting binaries redeployed, and any vendored copies must be refreshed. The new code returns an explicit error for shortstr values over 255 bytes, so callers should also handle that error path rather than assuming serialization always succeeds, and a behavioural side effect of upgrading is that previously silent truncation of oversized properties will now surface as write errors that can break callers that were unknowingly relying on the buggy behavior. As a compensating control for systems that cannot immediately upgrade, validate and reject or explicitly truncate shortstr property values at the application boundary before they are handed to the client, enforce a maximum of 255 bytes on untrusted fields such as CorrelationId, ReplyTo, MessageId, UserId, AppId, ContentType, ContentEncoding, Type, and Expiration, and avoid sourcing these properties from untrusted input; the trade-off is that strict rejection will drop messages that were previously (incorrectly) accepted and delivered with corrupted metadata, so log and monitor those events during rollout. Broker-side RabbitMQ configuration does not mitigate this issue, since the corruption occurs during client-side serialization before the frame ever leaves the process. Advisory reference: https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-j497-x9hr-x34x.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AMQP 0.9.1 encodes a 'shortstr' as a one-byte length prefix followed by at most 255 bytes of UTF-8 content; the client library functions on message properties such as CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, and Type are serialized through writeShortstr in write.go. That function performs an unchecked narrowing conversion of the Go string length to uint8, the classic CWE-190 integer-overflow pattern: for input of 256 bytes or more the length byte wraps modulo 256, a truncated prefix is written to the wire, and no error is surfaced to the caller. The affected component is the go module rabbitmq/amqp091-go, identified in the CPE data as cpe:2.3:a:rabbitmq:amqp091-go:*:*:*:*:*:*:*:* (all versions before 1.13.0). Because shortstr is a low-level framing primitive, the defect is not confined to a single API: every property or header field routed through writeShortstr inherits the same truncation behavior, and the corruption is silent, which is what makes it a data-integrity problem that can propagate into brokers, consumers, and any system relying on correlation identifiers for tracing or reply matching. The upstream fix (PR rabbitmq/amqp091-go#354, commit 6959423aa2784a1971e399175dfb2065dea0f3b0) adds an explicit length check that returns an error when the value exceeds 255 bytes, with unit tests covering the 256-byte rejection and the exact 255-byte success boundary.
Know when Rabbitmq gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:L
Attacker-supplied data reaches the app over the network (AV:N) but exploitation requires the app to accept a >255-byte property value (AC:H); no confidentiality impact, silent corruption yields I:H, downstream breakage only A:L.
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.
Technical POC Analysis
CWE-190 (Integer Overflow or Wraparound).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
A critical-severity flaw in the RabbitMQ amqp091-go client library (versions prior to 1.13.0) causes silent corruption of message metadata whenever an application assigns an oversized value to common message properties such as CorrelationId, ReplyTo, or MessageId - the message is sent without any error, but arrives with malformed routing and correlation data. The practical consequence for the business is not data theft or system compromise but broken request/reply correlation, misrouted messages, and lost traceability in any Go-based service that handles externally influenced data, which can disrupt order processing, workflow orchestration, and audit trails. Leadership should care because this is a widespread, hard-to-detect integrity risk embedded in a common library; it is unauthenticated (PR:N) and no public exploit code or confirmed active exploitation was identified at time of analysis, but AC:H means impact depends on whether untrusted data reaches these properties in our own applications.
Apply vendor patch (upgrade amqp091-go to 1.13.0, pending vendor confirmation of availability). Until that upgrade is complete, enforce application-layer validation and truncation/rejection of any value assigned to shortstr message properties (255-byte limit), and prioritize remediation for services that accept externally influenced data into those fields.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Sensitive credential disclosure in RabbitMQ affects installations running the management plugin with OAuth 2 configured
Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x ver
Denial of service in the RabbitMQ Java client library (com.rabbitmq:amqp-client ≤ 5.30.0) allows a malicious or compromi
An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.
Parsing desynchronization in the RabbitMQ amqp091-go AMQP 0.9.1 client library before 1.13.0 lets a malicious or comprom
RabbitMQ's amqp091-go Go client library, in all versions before 1.13.0, builds TLS configuration from amqps:// URIs with
RabbitMQ is a multi-protocol messaging broker. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploita
RabbitMQ brokers that use the OAuth2 plugin can silently fall back to disabled TLS certificate verification when no CA b
TLS client-authentication bypass in the RabbitMQ trust-store plugin lets a remote unauthenticated attacker whose forged
TLS certificate validation is completely bypassed in the RabbitMQ Java client library (`com.rabbitmq:amqp-client`) prior
Denial of service in the official RabbitMQ Go client library amqp091-go (versions prior to 1.13.0): a malicious, comprom
Memory-exhaustion denial of service in the official RabbitMQ Go AMQP 0.9.1 client library (amqp091-go) prior to 1.13.0 l
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.0 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| openSUSE Leap 16.0 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP1 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP2 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP3 | Affected |
| SUSE Linux Enterprise Module for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | Affected |
Exploit-DB