Critical AMQP091-Go Parser Desync Flaw Enables Frame Injection in RabbitMQ Clients (CVE-2026-77411)

A newly published GitHub Security Advisory (GHSA-c5pq-fr2g-9jpf) discloses a critical parsing flaw in github.com/rabbitmq/amqp091-go, the Go client library for the AMQP 0-9-1 protocol used by RabbitMQ. According to the advisory, the readLongstr function's bounds check silently aborts and returns "", nil when a declared string length exceeds 2^31 - 1, without consuming the corresponding bytes from the stream. A public proof-of-concept is noted as available.

What Happened

The advisory describes an improper error-handling path: when a long-string length field inside an AMQP table exceeds the max signed 32-bit integer, the parser returns as if the read succeeded but never advances the buffer cursor. Every subsequent read is thrown out of alignment with the underlying stream.

Why It Matters

Per the advisory, this desynchronization lets attacker-controlled trailing bytes be reinterpreted as new AMQP frame headers — potentially forging frames like connection.close, channel.open, or publish frames. The advisory characterizes the potential impact as ranging up to remote code execution, data injection, or full connection hijacking. Any service embedding amqp091-go to speak AMQP 0-9-1 (commonly RabbitMQ clients) that parses attacker-influenced or untrusted AMQP payloads is potentially affected; the practical blast radius will depend on how each consuming application uses the library and has not been independently verified here.

What Defenders Should Do Now

• Inventory services and internal tooling that depend on github.com/rabbitmq/amqp091-go and check for a patched release per the advisory.
• Where upgrading isn't immediate, restrict which peers can open AMQP connections to affected services (network segmentation, mutual TLS, broker-side ACLs) to limit exposure to untrusted payloads.
• Watch broker and client logs for anomalous connection behavior following table/long-string fields — unexpected mid-session frame types, abrupt channel/connection state changes, or malformed frame sequences that don't match expected application logic.
• If you operate packet capture or protocol-aware monitoring on AMQP traffic, flag long-string length fields near or above the 2^31-1 boundary as a hunting signal.

Developing Intel

This is a same-day advisory (published 2026-09-17) and details — including affected version ranges and a confirmed fix — should be verified directly against the source before acting. See the original GitHub Security Advisory: GHSA-c5pq-fr2g-9jpf.