# CVE-2026-77408: RabbitMQ amqp091-go silent data truncation via shortstr integer overflow

Source: https://junglewise.ai/threats/cve-2026-77408-rabbitmq-amqp091-go-silent-data-truncation-via-shortstr-integer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77408 · Severity: critical · CVSS 4 · Published 2026-09-16

A Go AMQP client library used by applications to publish messages to RabbitMQ silently truncates metadata fields (like message IDs and routing keys) longer than 255 bytes. An attacker who can supply long metadata strings can cause message routing to break silently, leading to undelivered replies, lost transactions, and broken request-response correlations across distributed systems.

Technologies: [github.com/rabbitmq/amqp091-go (Go)](https://junglewise.ai/threats/technologies/github-com-rabbitmq-amqp091-go), [RabbitMQ Amqp091-Go](https://junglewise.ai/threats/technologies/amqp091-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [RabbitMQ](https://junglewise.ai/threats/vendors/rabbitmq).

## Quick answers

**Is CVE-2026-77408 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77408 being exploited in the wild.

**How severe is CVE-2026-77408?** Critical severity, with a CVSS score of 4, published 16 September 2026.

**Which products and versions are affected?** github.com/rabbitmq/amqp091-go (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0.

**Is there a fix for CVE-2026-77408?** Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77408 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-77408?** Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later

  ```sh
  go get github.com/rabbitmq/amqp091-go@v1.13.0
  ```


## Technical details

The vulnerability exists in AMQP short string (shortstr) serialization logic in write.go, where string lengths are explicitly cast to uint8 without bounds checking. Strings exceeding 255 bytes silently wrap (e.g., 300 bytes becomes length 44), causing the wire protocol to transmit only a truncated portion of the string. No error is returned to the application, which believes the full payload was sent successfully. The TCP framing remains valid, but the business logic is corrupted—affected fields include CorrelationId, ReplyTo, MessageId, and other standard AMQP properties. An attacker controlling metadata (user tracking IDs, content-type headers, etc.) can break RPC routing and cause distributed transactions to hang or fail silently.

## Affected products

- RabbitMQ amqp091-go

## Identifiers

- CVE-2026-77408
- GHSA-j497-x9hr-x34x
- GO-2026-6498

## Timeline

- 2026-09-17: disclosed
- advisory: GHSA-j497-x9hr-x34x

## Related threats

- [amqp091-go pre-negotiation frame limit bypass in connection reader](https://junglewise.ai/threats/cve-2026-107386-amqp091-go-pre-negotiation-frame-limit-is-not-enforced-to-4kb)
- [RabbitMQ amqp091-go denial of service via malicious field length](https://junglewise.ai/threats/cve-2026-77412-rabbitmq-amqp091-go-denial-of-service-via-malicious-field-length)
- [RabbitMQ amqp091-go protocol desynchronization via integer overflow](https://junglewise.ai/threats/cve-2026-77411-rabbitmq-amqp091-go-protocol-desynchronization-via-integer)
- [RabbitMQ amqp091-go resource exhaustion via unbounded buffer allocation](https://junglewise.ai/threats/cve-2026-77410-rabbitmq-amqp091-go-resource-exhaustion-via-unbounded-buffer)
- [RabbitMQ amqp091-go synchronous notification blocking](https://junglewise.ai/threats/cve-2026-77409-rabbitmq-amqp091-go-synchronous-notification-blocking)