Listen to this Post
CVE-2026-77408 is a critical integer overflow or wraparound vulnerability (CWE-190) in the RabbitMQ amqp091-go client library, affecting all versions prior to 1.13.0. The flaw resides in the `writeShortstr` function within write.go, which serializes AMQP short string (shortstr) fields—such as CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, and Type—by casting the byte length of the string directly to a `uint8` without first validating that the length does not exceed 255 bytes. Because `uint8` can only represent values from 0 to 255, any string longer than 255 bytes causes the length counter to silently wrap around; for example, a 300-byte string wraps to 44 (300 mod 256 = 44). The underlying stream writer then reads this wrapped length to determine how many bytes to pull from the buffer, writing only a truncated prefix of the original string into the outgoing connection buffer while reporting no error to the application. Crucially, the TCP stream remains properly framed because the shortened length matches the bytes actually written, but the business logic at the application layer is corrupted. An attacker who can influence metadata fields processed by an upstream application—such as a user-supplied tracking ID or an overly long `ContentType` header—can exploit this to break system components. For instance, a user passes a 300-byte `CorrelationId` through an application endpoint; the library wraps the length to 44 and transmits only the first 44 bytes to the RabbitMQ broker. When the service processes the request and responds, the replying consumer attempts to route the message using the full 300-byte identifier, but because the broker only recognizes the truncated 44-byte ID, the reply loop breaks silently, leading to hanging processes, dropped messages, or data leaks across transaction boundaries. This silent metadata corruption can break request-reply correlation, routing, distributed tracing (e.g., OpenTelemetry or Jaeger trace identifiers), and downstream message processing. The vulnerability is classified under both CWE-190 (Integer Overflow or Wraparound) and CWE-20 (Improper Input Validation). The issue is fixed in version 1.13.0, where `writeShortstr` has been patched to reject strings exceeding the 255-byte limit before serialization begins.
DailyCVE Form:
Platform: RabbitMQ amqp091-go
Version: < 1.13.0
Vulnerability : Integer truncation
Severity: Critical (CVSS 9.1)
date: 2026-09-16
Prediction: 2026-09-23
What Undercode Say:
Search for vulnerable versions in Go projects:
grep -r "github.com/rabbitmq/amqp091-go" --include="go.mod" .
Check the installed version:
go list -m github.com/rabbitmq/amqp091-go
Simulated vulnerable code path in `write.go:246`:
// Vulnerable serialization of a shortstr field
func writeShortstr(w io.Writer, s string) error {
b := []byte(s)
length := uint8(len(b)) // wraps silently when len(b) > 255
if _, err := w.Write([]byte{length}); err != nil {
return err
}
_, err := w.Write(b[:length]) // writes only truncated prefix
return err
}
Demonstration of the truncation in Go:
package main
import "fmt"
func main() {
s := string(make([]byte, 300)) // 300-byte string
length := uint8(len(s))
fmt.Printf("Original length: %d, Wrapped length: %d\n", len(s), length)
// Output: Original length: 300, Wrapped length: 44
}
Exploit: (Educational Purposes!)
An attacker can supply an oversized `CorrelationId` or `ContentType` through an application endpoint that forwards the value to the amqp091-go publisher. The wrapped length (e.g., 300 → 44) causes only the first 44 bytes to be transmitted. The broker stores the truncated ID, while the responding service attempts correlation with the full 300-byte ID, breaking the reply loop. This can lead to hanging RPC calls, message misrouting, or cross-transaction data leaks.
Protection: from this CVE
Upgrade `github.com/rabbitmq/amqp091-go` to version 1.13.0 or later. If immediate upgrade is not possible, implement strict application-layer validation to reject any `shortstr` property value longer than 255 bytes before passing it to the AMQP client.
Impact:
Silent protocol desynchronization at the application layer. The TCP stream remains correctly framed, but business logic is corrupted. Distributed transactions, request-reply correlations, and tracing headers are truncated, causing downstream systems to drop messages, route them to incorrect consumers, or hang indefinitely. Integrity impact is HIGH, availability impact is HIGH, and confidentiality impact is LOW.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
