CVE-2026-77408

The record

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.

Affected packages

Related vulnerabilities

• CVE-2026-54241 libde265 is an open source implementation of the h.265 video codec. CWE-190
• CVE-2026-54240 libde265 is an open source implementation of the h.265 video codec. CWE-190
• CVE-2026-38350 An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg… CWE-190
• CVE-2026-59982 OpenEXR is the reference implementation and specification for the EXR image format… CWE-190
• CVE-2026-59186 OpenEXR is the reference implementation and specification for the EXR image format… CWE-190
• CVE-2026-59183 OpenEXR is the reference implementation and specification for the EXR image format… CWE-190
• CVE-2026-54920 OpenEXR is the reference implementation and specification for the EXR image format… CWE-190
• CVE-2026-55373 OpenEXR is the reference implementation and specification for the EXR image format… CWE-190