CVE-2026-77412

Name	CVE-2026-77412
Description	RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compromised broker can encode a value such as 0xFFFFFFFF, which becomes -1 and causes a len out of range runtime panic. The panic escapes the network reader goroutine and terminates the client process, including during connection.start server properties or message header table parsing. This issue is fixed in version 1.13.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
golang-github-rabbitmq-amqp091-go (PTS)	bookworm	1.5.0-2	vulnerable
	trixie	1.10.0-1	vulnerable
	forky, sid	1.15.0-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
golang-github-rabbitmq-amqp091-go	source	(unstable)	1.14.0-1

Notes

[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
[bookworm] - golang-github-rabbitmq-amqp091-go <postponed> (Limited support, minor issue)
https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3
https://github.com/rabbitmq/amqp091-go/pull/344
https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf (v1.13.0)