CVE-2026-77406

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.Qos in channel.go accepts negative prefetchCount and prefetchSize integers and casts them directly to uint16 and uint32 fields in the basic.qos method because validateQos is absent. Values such as -1 therefore wrap to 65535 or 4294967295 instead of being rejected. An application that permits untrusted configuration of these Qos values can unintentionally request extremely large prefetch limits, allowing a broker to deliver enough queued messages to exhaust client memory and disrupt processing. This issue is fixed in version 1.13.0.

• CWE-195

• https://github.com/rabbitmq/amqp091-go/commit/3b879e1d1d25b544e26b3bc3d7db3213203c0f3b
• https://github.com/rabbitmq/amqp091-go/pull/351
• https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0
• https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-rm6m-hrcw-jw33

Published

Sep 16, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77399icalendar is an RFC 5545 compatible parser and generator of …6.5
• CVE-2026-7740A security vulnerability has been detected in justdan96 tsMu…3.3
• CVE-2026-77401Zope AccessControl provides a general security framework for…6.8
• CVE-2026-77403RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.9
• CVE-2026-77404RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.7
• CVE-2026-77405RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…9.4
• CVE-2026-77407RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…7
• CVE-2026-77408RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…9.1
• CVE-2026-77409RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.2
• CVE-2026-7741A vulnerability was detected in CodeAstro Online Classroom 1…6.3
• CVE-2026-77410RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.9
• CVE-2026-77411RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…9.5