{"id":"CVE-2026-77412","revision":"c310309b69774fe6ae809f02f1b3fdd4","records":[{"revision":"c310309b69774fe6ae809f02f1b3fdd4","observedAt":"2026-10-25T16:19:04.694+00:00","statement":{"source":"nvd","id":"CVE-2026-77412","aliases":[],"title":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A …","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readField in read.go reads the length of an AMQP byte-array field with type tag x into a signed int32 and passes the value directly to make when allocating the field buffer. A malicious or compromised broker can encode a value such as 0xFFFFFFFF, which becomes -1 and causes a len out of range runtime panic. The panic escapes the network reader goroutine and terminates the client process, including during connection.start server properties or message header table parsing. This issue is fixed in version 1.13.0.","state":0,"publishedAt":"2026-09-16T15:17:50.707+00:00","modifiedAt":"2026-09-23T18:19:19.803+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.9,"severity":"HIGH"}],"references":["https://github.com/rabbitmq/amqp091-go/commit/669b42bf7b1db76bc6d4973e3634247f680accbf","https://github.com/rabbitmq/amqp091-go/pull/344","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0","https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-4v58-74mf-rjx3"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77412","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-681"],"productCriteria":[],"sourceDates":{"published":"2026-09-16T15:17:50.707","lastModified":"2026-09-23T18:19:19.803"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-77412","identifiers":["CVE-2026-77412"]},"retained":false,"historicalAffected":[]}],"coverage":[]}