CVE-2026-77410

The record

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the message body slice with the uint64 ch.header.Size value supplied by an AMQP content header without capping the allocation to the negotiated Connection.Config.FrameSize value. A malicious or compromised broker can send an extreme declared body size and cause the Go runtime to attempt a correspondingly large allocation before body data is received. The allocation can exhaust memory and terminate the client process. This issue is fixed in version 1.13.0.

Affected packages

Related vulnerabilities

• CVE-2026-77301 adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. CWE-789
• CVE-2026-53716 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or… CWE-789
• CVE-2026-53717 Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or… CWE-789
• CVE-2026-77354 kin-openapi is a Go project for handling OpenAPI files. CWE-789
• CVE-2026-69219 The RabbitMQ Java client library allows Java and JVM-based applications to connect to and… CWE-789
• CVE-2026-66485 GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at… CWE-789
• CVE-2026-59844 A flaw was found in libssh. CWE-789
• CVE-2026-40378 Memory allocation with excessive size value in Windows Local Security Authority Subsystem… CWE-789