CVE-2026-77408

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.

• CWE-190

• https://github.com/rabbitmq/amqp091-go/commit/6959423aa2784a1971e399175dfb2065dea0f3b0
• https://github.com/rabbitmq/amqp091-go/pull/354
• https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0
• https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-j497-x9hr-x34x

Published

Sep 16, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77401Zope AccessControl provides a general security framework for…6.8
• CVE-2026-77403RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.9
• CVE-2026-77404RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.7
• CVE-2026-77405RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…9.4
• CVE-2026-77406RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.2
• CVE-2026-77407RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…7
• CVE-2026-77409RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.2
• CVE-2026-7741A vulnerability was detected in CodeAstro Online Classroom 1…6.3
• CVE-2026-77410RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.9
• CVE-2026-77411RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…9.5
• CVE-2026-77412RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.9
• CVE-2026-77413JSONata is a JSON query and transformation language. Prior t…9.3