Executive brief
A Go AMQP client library used by applications to publish messages to RabbitMQ silently truncates metadata fields (like message IDs and routing keys) longer than 255 bytes. An attacker who can supply long metadata strings can cause message routing to break silently, leading to undelivered replies, lost transactions, and broken request-response correlations across distributed systems.
Technical details
The vulnerability exists in AMQP short string (shortstr) serialization logic in write.go, where string lengths are explicitly cast to uint8 without bounds checking. Strings exceeding 255 bytes silently wrap (e.g., 300 bytes becomes length 44), causing the wire protocol to transmit only a truncated portion of the string. No error is returned to the application, which believes the full payload was sent successfully. The TCP framing remains valid, but the business logic is corrupted—affected fields include CorrelationId, ReplyTo, MessageId, and other standard AMQP properties. An attacker controlling metadata (user tracking IDs, content-type headers, etc.) can break RPC routing and cause distributed transactions to hang or fail silently.
Affected products
- RabbitMQ amqp091-go
Timeline
- 2026-09-17: disclosed
- advisory: GHSA-j497-x9hr-x34x