VulnSocial

CVE-2026-77411Patch

LOWCVSS 9.5 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning ErrSyntax. The function leaves the declared field bytes unread, while readTable treats the operation as successful and continues parsing from the wrong offset. A malicious or compromised broker can provide an oversized longstr in a table field and desynchronize subsequent AMQP parsing, causing attacker-controlled trailing bytes to be interpreted as later fields or frames and disrupting connection integrity and availability. This issue is fixed in version 1.13.0.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-754

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-16); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-16: 1Mentions · 2026-09-18: 1Patch / Workaround · 2026-09-16: 1Technical Details · 2026-09-16: 1Technical Details · 2026-09-18: 109-1609-18
Signal classification2 categories
Patch
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-161
Patch1
2026-09-181
Disclosure1
Full discourse2 posts
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen Kritische Lücken in RabbitMQ amqp091-go: Drei CVEs bis CVSS 9.5 vor Version 1.13.0 #amqp #amqp091go #cve202677405 #cve202677408 #cve202677411 #go #rabbitmq https://cybersecurity-news.de/rabbitmq-amqp091-go-cve-2026-77405-cve-2026-77408-cve-2026-77411

    Post summary

    The text announces three critical CVEs affecting RabbitMQ amqp091-go before version 1.13.0, with CVSS severity up to 9.5. It does not mention PoC, exploit code, active exploitation, or remediation.

    0000036
    13 followersView on X
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨High - amqp091-go oversized longstr mishandling (CVE-2026-77411) In rabbitmq/amqp091-go before 1.13.0, readLongstr returns "" + nil (instead of ErrSyntax) when an AMQP longstr length exceeds 0x7FFFFFFF. A malicious or compromised broker can craft a table field that leaves bytes unread, so readTable continues from the wrong offset and misinterprets attacker-controlled trailing data as later fields/frames. This breaks connection integrity and enables DoS. 👉Affected: http://github.com/rabbitmq/amqp091-go < 1.13.0 | Upgrade to 1.13.0

    Post summary

    The text discloses CVE-2026-77411 with detailed technical vulnerability information (a longstr mishandling bug in amqp091-go leading to DoS) and explicitly recommends upgrading to version 1.13.0 as the fix, but does not reference any PoC, exploit tool, or active exploitation.

    0000071
    305 followersView on X

Explore more

Back to dashboard