CVE-2026-77408
Description
A numeric truncation flaw was found in the RabbitMQ amqp091-go Go client library. The writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without rejecting values longer than 255 bytes. An application that publishes AMQP messages with oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type fields silently serializes a wrapped length and a truncated prefix, reporting no error. The resulting metadata corruption can break request-reply correlation, routing, tracing, and downstream message processing.
Statement
A numeric truncation flaw was found in the RabbitMQ amqp091-go Go AMQP 0.9.1 client library. The writeShortstr function casts the byte length of AMQP shortstr property values to uint8 without first rejecting values exceeding 255 bytes. When an application publishes an AMQP message with an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type field, the length silently wraps around and only a truncated prefix is serialized to the wire, with no error returned to the caller. The resulting metadata corruption can break request-reply correlation, message routing, distributed tracing, and downstream processing. This is a data integrity issue — no code execution, confidentiality breach, or direct availability impact occurs.
Mitigation
Ensure that AMQP shortstr property values (CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, Type) do not exceed 255 bytes before publishing messages. Applications that accept externally-supplied values for these fields should validate and reject oversized inputs at the application boundary.
Upgrade to a patched version which returns an error in case length >= 255.
Fix diff: https://github.com/rabbitmq/amqp091-go/commit/6959423aa2784a1971e399175dfb2065dea0f3b0
go
func writeShortstr(w io.Writer, s string) (err error) {
b := []byte(s)
if len(b) > 255 {
return fmt.Errorf("amqp: shortstr %q exceeds 255 bytes", s)
}
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Varies by Context
When a primitive is cast to a smaller primitive, the high order bits of the large value are lost in the conversion, potentially resulting in an unexpected value that is not equal to the original value. This value may be required as an index into a buffer, a loop iterator, or simply necessary state data. In any case, the value cannot be trusted and the system will be in an undefined state.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
