# CVE-2026-77410: RabbitMQ amqp091-go resource exhaustion via unbounded buffer allocation

Source: https://junglewise.ai/threats/cve-2026-77410-rabbitmq-amqp091-go-resource-exhaustion-via-unbounded-buffer  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-77410 · Severity: high · CVSS 4 · Published 2026-09-16

The RabbitMQ Go AMQP client library does not validate the size of message bodies before allocating memory for them. A malicious or compromised AMQP broker can send a message with an extremely large declared size, causing the client application to attempt allocation of exabyte-scale memory buffers. This immediately exhausts system memory and triggers termination of the client process, resulting in service disruption and loss of in-flight work.

Technologies: [github.com/rabbitmq/amqp091-go (Go)](https://junglewise.ai/threats/technologies/github-com-rabbitmq-amqp091-go), [RabbitMQ Amqp091-Go](https://junglewise.ai/threats/technologies/amqp091-go). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [RabbitMQ](https://junglewise.ai/threats/vendors/rabbitmq).

## Quick answers

**Is CVE-2026-77410 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77410 being exploited in the wild.

**How severe is CVE-2026-77410?** High severity, with a CVSS score of 4, published 16 September 2026.

**Which products and versions are affected?** github.com/rabbitmq/amqp091-go (Go) < 1.13.0, SEMVER:introduced=0,fixed=1.13.0.

**Is there a fix for CVE-2026-77410?** Yes. github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77410 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-77410?** Check whether you run github.com/rabbitmq/amqp091-go (Go) or RabbitMQ Amqp091-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/rabbitmq/amqp091-go (Go): upgrade to 1.13.0 or later

  ```sh
  go get github.com/rabbitmq/amqp091-go@v1.13.0
  ```


## Technical details

The vulnerability exists in the `recvContent` function within the amqp091-go library's channel implementation. When processing a message content header frame, the code pre-allocates a slice buffer based on the `ch.header.Size` field (a 64-bit unsigned integer) without validation against the negotiated frame size limit (`FrameMax`). An attacker controlling or compromising an AMQP broker can craft a `basic.deliver` frame with an inflated body-size value (e.g., 2^62 bytes), causing the Go runtime to attempt allocation of impossible amounts of memory. No authentication or special privileges are required; the crash occurs during normal message consumption. The fix requires capping the pre-allocated buffer size to a reasonable maximum, typically the negotiated `FrameMax` value.

## Affected products

- RabbitMQ amqp091-go

## Identifiers

- CVE-2026-77410
- GHSA-r9c8-gcjp-xfwh
- GO-2026-6500

## Timeline

- 2026-09-17: disclosed

## Related threats

- [amqp091-go pre-negotiation frame limit bypass in connection reader](https://junglewise.ai/threats/cve-2026-107386-amqp091-go-pre-negotiation-frame-limit-is-not-enforced-to-4kb)
- [RabbitMQ amqp091-go denial of service via malicious field length](https://junglewise.ai/threats/cve-2026-77412-rabbitmq-amqp091-go-denial-of-service-via-malicious-field-length)
- [RabbitMQ amqp091-go protocol desynchronization via integer overflow](https://junglewise.ai/threats/cve-2026-77411-rabbitmq-amqp091-go-protocol-desynchronization-via-integer)
- [RabbitMQ amqp091-go synchronous notification blocking](https://junglewise.ai/threats/cve-2026-77409-rabbitmq-amqp091-go-synchronous-notification-blocking)
- [RabbitMQ amqp091-go silent data truncation via shortstr integer overflow](https://junglewise.ai/threats/cve-2026-77408-rabbitmq-amqp091-go-silent-data-truncation-via-shortstr-integer)