Listen to this Post
CVE-2026-77410 is a high-severity resource exhaustion vulnerability affecting the RabbitMQ amqp091-go library, a Go AMQP 0.9.1 client, in versions prior to 1.13.0. The flaw resides in the `Channel.recvContent` function within channel.go, which is responsible for receiving message content payloads from an AMQP broker. When a content header is received, the function reads the `ch.header.Size` field—a 64-bit unsigned integer (uint64)—and uses it to pre-allocate the message body slice for performance optimization. The critical issue is that this allocation size is never validated or capped against any upper boundary, such as the maximum frame size (FrameMax) negotiated during connection establishment. A malicious or compromised AMQP broker can exploit this by sending a standard `basic.deliver` frame containing a content header with an intentionally inflated `body-size` variable, for example setting it to 2^62 bytes. When the client processes this header, the Go runtime attempts to allocate an exabyte-scale slice capacity, immediately exhausting available system memory. The host operating system’s OOM killer then terminates the client process. No special privileges or authentication bypasses are required; the crash occurs seamlessly during normal message consumption. The vulnerability is classified as CWE-789 (Memory Allocation with Excessive Size Value) and has a CVSS 4.0 score of 8.9, indicating high availability impact. The issue is fixed in version 1.13.0, which enforces the negotiated frame size limit during content body pre-allocation.
DailyCVE Form:
Platform: RabbitMQ amqp091-go
Version: < 1.13.0
Vulnerability: Unbounded OOM
Severity: High
date: 2026-09-16
Prediction: 2026-09-18
What Undercode Say:
Analyze recvContent allocation behavior
grep -n "recvContent" channel.go
Expected output: function definition and body pre-allocation logic
Inspect the vulnerable allocation line
sed -n '495,496p' channel.go
if cap(ch.body) == 0 {
ch.body = make([]byte, 0, ch.header.Size) // unbounded
Reproduce with a crafted AMQP content header
(Educational: use a local AMQP broker with modified content header)
Set ch.header.Size = 4611686018427387904 (2^62)
Observe Go runtime panic: "runtime: out of memory"
Check negotiated frame size
grep -n "FrameMax" connection.go
Verify that allocation is not capped against this value
How Exploit: (Educational Purposes!)
Pseudocode for educational demonstration 1. Establish connection to vulnerable client 2. Send basic.deliver with content header 3. Set body-size = 2^62 4. Client recvContent pre-allocates huge slice 5. OOM killer terminates process This requires a malicious AMQP broker or MITM position.
Protection: from this CVE
Update to patched version go get github.com/rabbitmq/[email protected] Verify version go list -m github.com/rabbitmq/amqp091-go
Impact:
Availability: High. Exploded memory consumption results in instant process termination, destroying application state and availability for all threads sharing the environment.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
