Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-16T14:48:00 github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Denial of Service due to synchronous event channel blocking 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.dispatch in channel.go, confirms.confirm in confirms.go, and Connection.dispatch0 in connection.go synchronously send publisher confirmations, flow-control events, consumer cancellations, returned messages, including NotifyConfirm events and connection block notifications, to application-provided channels. If a listener channel is unbuffered, full, or not drained promptly, the sole reader goroutine blocks and stops processing frames, acknowledgments, deliveries, and heartbeats. Broker-driven event bursts can therefore cause connection stalls, missed heartbeats, deadlocks, and disconnection. This issue is fixed in version 1.13.0.

A flaw was found in RabbitMQ amqp091-go, a Go AMQP 0.9.1 client. When the client synchronously sends events to application-provided channels, an unbuffered or full listener channel can cause the client's reader to block. This blockage prevents the processing of critical messages and heartbeats, leading to connection stalls, deadlocks, and disconnections. This vulnerability can result in a Denial of Service (DoS) for applications using the affected component.

This flaw has an Important impact because a broker-driven event burst can block AMQP client processing when application notification channels are unbuffered, full, or not promptly drained. The resulting stall can cause missed heartbeats, deadlocks, or client disconnection. Use adequately buffered notification channels and ensure event consumers continuously drain them. Update applications using amqp091-go when a fixed version is available. Red Hat Hardened Images 2026-09-16T00:00:00Z RHSA-2026:68290 opentelemetry-collector-contrib-main-0.161.0-0.1.hum1 Cryostat 4 Not affected cryostat/cryostat-storage-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator Multicluster Global Hub Affected multicluster-globalhub/multicluster-globalhub-grafana-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-plugin-event-sender-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/acm-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/volsync-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/volsync-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso-operators/rabbitmq-cluster-rhel9-operator Red Hat Quay 3 Affected quay/clair-rhel8 Red Hat Quay 3 Affected quay/clair-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-77409 https://nvd.nist.gov/vuln/detail/CVE-2026-77409 https://github.com/rabbitmq/amqp091-go/commit/5b0ccbb8d7bc3dfa18129d9b0f9256d656809494 https://github.com/rabbitmq/amqp091-go/pull/349 https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0 https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-wxx3-cj7g-w73j