Is CVE-2026-77408 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77408 being exploited in the wild.

How severe is CVE-2026-77408?

Critical severity, with a CVSS score of 4, published 16 September 2026.

Which products and versions are affected?

github.com/rabbitmq/amqp091-go (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0.

Is there a fix for CVE-2026-77408?

Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77408 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77408?

Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77408: RabbitMQ amqp091-go silent data truncation via shortstr integer overflow

Q: Is there a fix for CVE-2026-77408?

Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77408 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-77408?

Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77408 · Severity: critical · CVSS 4 · Published 2026-09-16

A Go AMQP client library used by applications to publish messages to RabbitMQ silently truncates metadata fields (like message IDs and routing keys) longer than 255 bytes. An attacker who can supply long metadata strings can cause message routing to break silently, leading to undelivered replies, lost transactions, and broken request-response correlations across distributed systems.

Technologies: github.com/rabbitmq/amqp091-go (Go), RabbitMQ Amqp091-Go. Vendors: Go, RabbitMQ.

Quick answers

Is CVE-2026-77408 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77408 being exploited in the wild.
How severe is CVE-2026-77408?: Critical severity, with a CVSS score of 4, published 16 September 2026.
Which products and versions are affected?: github.com/rabbitmq/amqp091-go (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0.
Is there a fix for CVE-2026-77408?: Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77408 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77408?: Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later
```
go get github.com/rabbitmq/amqp091-go@v1.13.0
```

Technical details

The vulnerability exists in AMQP short string (shortstr) serialization logic in write.go, where string lengths are explicitly cast to uint8 without bounds checking. Strings exceeding 255 bytes silently wrap (e.g., 300 bytes becomes length 44), causing the wire protocol to transmit only a truncated portion of the string. No error is returned to the application, which believes the full payload was sent successfully. The TCP framing remains valid, but the business logic is corrupted—affected fields include CorrelationId, ReplyTo, MessageId, and other standard AMQP properties. An attacker controlling metadata (user tracking IDs, content-type headers, etc.) can break RPC routing and cause distributed transactions to hang or fail silently.

Affected products

RabbitMQ amqp091-go

Identifiers

CVE-2026-77408
GHSA-j497-x9hr-x34x
GO-2026-6498

Timeline

2026-09-17: disclosed
advisory: GHSA-j497-x9hr-x34x

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.