CVE-2026-77406

Name	CVE-2026-77406
Description	RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 or 4294967295 instead of being rejected. An application that permits untrusted configuration of these Qos values can unintentionally request extremely large prefetch limits, allowing a broker to deliver enough queued messages to exhaust client memory and disrupt processing. This issue is fixed in version 1.13.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-github-rabbitmq-amqp091-go (PTS)	bookworm	1.5.0-2	vulnerable
	trixie	1.10.0-1	vulnerable
	forky, sid	1.15.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-github-rabbitmq-amqp091-go	source	(unstable)	1.14.0-1

Notes

[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
[bookworm] - golang-github-rabbitmq-amqp091-go <postponed> (Limited support, minor issue)
https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-rm6m-hrcw-jw33
https://github.com/rabbitmq/amqp091-go/pull/351
https://github.com/rabbitmq/amqp091-go/commit/3b879e1d1d25b544e26b3bc3d7db3213203c0f3b (v1.13.0)