CVE-2026-77406: falha de alta gravidade em rabbitmq amqp091-go
RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.5%
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 or 4294967295 instead of being rejected. An application that permits untrusted configuration of these Qos values can unintentionally request extremely large prefetch limits, allowing a broker to deliver enough queued messages to exhaust client memory and disrupt processing. This issue is fixed in version 1.13.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Produtos afetados
rabbitmq · amqp091-goCVEs relacionadas — rabbitmq amqp091-go
No mesmo produto, das mais perigosas para as menos.
CVE-2026-79921HIGHamqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized PayloadEPSS 0.5%CVE-2026-77409HIGHRabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel BlockingEPSS 0.5%CVE-2026-77411CRITICALRabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstrEPSS 0.5%CVE-2026-77412HIGHRabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP ClientEPSS 0.5%CVE-2026-77410HIGHRabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer AllocationEPSS 0.5%CVE-2026-77403HIGHRabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size NegotiationEPSS 0.5%