Is CVE-2026-77410 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77410 being exploited in the wild.

How severe is CVE-2026-77410?

High severity, with a CVSS score of 4, published 16 September 2026.

Which products and versions are affected?

github.com/rabbitmq/amqp091-go (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0.

Is there a fix for CVE-2026-77410?

Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77410 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77410?

Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77410: RabbitMQ amqp091-go resource exhaustion via unbounded buffer allocation

Q: Is there a fix for CVE-2026-77410?

Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-77410 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-77410?

Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77410 · Severity: high · CVSS 4 · Published 2026-09-16

The RabbitMQ Go AMQP client library does not validate the size of message bodies before allocating memory for them. A malicious or compromised AMQP broker can send a message with an extremely large declared size, causing the client application to attempt allocation of exabyte-scale memory buffers. This immediately exhausts system memory and triggers termination of the client process, resulting in service disruption and loss of in-flight work.

Technologies: github.com/rabbitmq/amqp091-go (Go), RabbitMQ Amqp091-Go. Vendors: Go, RabbitMQ.

Quick answers

Is CVE-2026-77410 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77410 being exploited in the wild.
How severe is CVE-2026-77410?: High severity, with a CVSS score of 4, published 16 September 2026.
Which products and versions are affected?: github.com/rabbitmq/amqp091-go (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0.
Is there a fix for CVE-2026-77410?: Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77410 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77410?: Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later
```
go get github.com/rabbitmq/amqp091-go@v1.13.0
```

Technical details

The vulnerability exists in the `recvContent` function within the amqp091-go library's channel implementation. When processing a message content header frame, the code pre-allocates a slice buffer based on the `ch.header.Size` field (a 64-bit unsigned integer) without validation against the negotiated frame size limit (`FrameMax`). An attacker controlling or compromising an AMQP broker can craft a `basic.deliver` frame with an inflated body-size value (e.g., 2^62 bytes), causing the Go runtime to attempt allocation of impossible amounts of memory. No authentication or special privileges are required; the crash occurs during normal message consumption. The fix requires capping the pre-allocated buffer size to a reasonable maximum, typically the negotiated `FrameMax` value.

Affected products

RabbitMQ amqp091-go

Identifiers

CVE-2026-77410
GHSA-r9c8-gcjp-xfwh
GO-2026-6500

Timeline

2026-09-17: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.