RabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel Blocking
Published Sep 16, 2026
8.2
HIGHCVSS 4.0
EPSS 0.52%
Description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.dispatch in channel.go, confirms.confirm in confirms.go, and Connection.dispatch0 in connection.go synchronously send publisher confirmations, flow-control events, consumer cancellations, returned messages, including NotifyConfirm events and connection block notifications, to application-provided channels. If a listener channel is unbuffered, full, or not drained promptly, the sole reader goroutine blocks and stops processing frames, acknowledgments, deliveries, and heartbeats. Broker-driven event bursts can therefore cause connection stalls, missed heartbeats, deadlocks, and disconnection. This issue is fixed in version 1.13.0.
Affected products
-
- Version < 1.13.0StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Rabbitmq | Amqp091-GO | n/a |
|
No data.
No data.
Red Hat Hardened Images
opentelemetry-collector-contrib-main-0.161.0-0.1.hum1
Fixed · RHSA-2026:68290
Cryostat 4
cryostat/cryostat-storage-rhel9
Not affected
Custom Metric Autoscaler operator for Red Hat Openshift
custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9
Not affected
Custom Metric Autoscaler operator for Red Hat Openshift
custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9
Not affected
Custom Metric Autoscaler operator for Red Hat Openshift
custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9
Not affected
Custom Metric Autoscaler operator for Red Hat Openshift
custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator
Not affected
Multicluster Global Hub
multicluster-globalhub/multicluster-globalhub-grafana-rhel9
Affected
OpenShift Serverless
openshift-serverless-1/kn-plugin-event-sender-rhel9
Affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/acm-grafana-rhel9
Affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/volsync-operator-bundle
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/volsync-rhel9
Not affected
Red Hat OpenStack Platform 18.0
rhoso-operators/rabbitmq-cluster-rhel9-operator
Affected
Red Hat Quay 3
quay/clair-rhel8
Affected
Red Hat Quay 3
quay/clair-rhel9
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Hardened Images | opentelemetry-collector-contrib-main-0.161.0-0.1.hum1 | Fixed | RHSA-2026:68290 |
| Cryostat 4 | cryostat/cryostat-storage-rhel9 | Not affected | n/a |
| Custom Metric Autoscaler operator for Red Hat Openshift | custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 | Not affected | n/a |
| Custom Metric Autoscaler operator for Red Hat Openshift | custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 | Not affected | n/a |
| Custom Metric Autoscaler operator for Red Hat Openshift | custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 | Not affected | n/a |
| Custom Metric Autoscaler operator for Red Hat Openshift | custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator | Not affected | n/a |
| Multicluster Global Hub | multicluster-globalhub/multicluster-globalhub-grafana-rhel9 | Affected | n/a |
| OpenShift Serverless | openshift-serverless-1/kn-plugin-event-sender-rhel9 | Affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/acm-grafana-rhel9 | Affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/volsync-operator-bundle | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/volsync-rhel9 | Not affected | n/a |
| Red Hat OpenStack Platform 18.0 | rhoso-operators/rabbitmq-cluster-rhel9-operator | Affected | n/a |
| Red Hat Quay 3 | quay/clair-rhel8 | Affected | n/a |
| Red Hat Quay 3 | quay/clair-rhel9 | Affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This flaw has an Important impact because a broker-driven event burst can block AMQP client processing when application notification channels are unbuffered, full, or not promptly drained. The resulting stall can cause missed heartbeats, deadlocks, or client disconnection.
Red Hat mitigation
Use adequately buffered notification channels and ensure event consumers continuously drain them. Update applications using amqp091-go when a fixed version is available.
References (8)
- https://access.redhat.com/security/cve/CVE-2026-77409 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2535494 Issue Tracking
- https://github.com/rabbitmq/amqp091-go/commit/5b0ccbb8d7bc3dfa18129d9b0f9256d656809494 x_refsource_MISC
- https://github.com/rabbitmq/amqp091-go/pull/349 x_refsource_MISC
- https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0 x_refsource_MISC
- https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-wxx3-cj7g-w73j x_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-77409
- https://www.cve.org/CVERecord?id=CVE-2026-77409
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2026-77409 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2535494 | Issue Tracking | |
| https://github.com/rabbitmq/amqp091-go/commit/5b0ccbb8d7bc3dfa18129d9b0f9256d656809494 | x_refsource_MISC | |
| https://github.com/rabbitmq/amqp091-go/pull/349 | x_refsource_MISC | |
| https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0 | x_refsource_MISC | |
| https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-wxx3-cj7g-w73j | x_refsource_CONFIRM | |
| https://nvd.nist.gov/vuln/detail/CVE-2026-77409 | ||
| https://www.cve.org/CVERecord?id=CVE-2026-77409 |
Change history (0)
No recorded changes yet.