Executive brief
RabbitMQ's AMQP protocol client library has a critical flaw in how it parses network messages. When a maliciously crafted message contains an oversized length value, the parser silently fails but leaves unread data in the stream, causing all subsequent messages to become misaligned. An attacker on the network can exploit this to inject fake commands, hijack connections, or potentially execute remote code.
Technical details
The vulnerability is a protocol desynchronization bug in the readLongstr function within the amqp091-go library's wire-protocol parser. When parsing a long string field within an AMQP table, a length value exceeding 2^31-1 (0x7FFFFFFF) triggers an integer overflow check that silently returns without consuming the specified bytes from the network buffer. This leaves the parser state misaligned: subsequent read operations interpret arbitrary bytes from the attacker-controlled payload as valid AMQP frame headers, allowing injection of forged protocol commands. The vulnerability requires network access to the AMQP server and affects any client or server using this library. Exploitation can result in frame injection, command hijacking, or remote code execution.
Affected products
- RabbitMQ amqp091-go <UNKNOWN>
Timeline
- 2026-09-17: disclosed