Resource Exhaustion in RabbitMQ amqp091-go via Unsafe Integer Casting

A resource exhaustion vulnerability (CVE-2026-77406) exists in the amqp091-go Go client library for RabbitMQ in versions prior to 1.13.0. The vulnerability stems from an unsafe signed-to-unsigned integer cast within the Qos configuration method. When a developer provides a negative integer (such as -1) as a sentinel value for prefetchCount or prefetchSize, the Go runtime uses two's complement arithmetic to cast the input to an unsigned uint16 or uint32.

This cast wraps the value to its maximum limit (65535 or 4,294,967,295, respectively). If an attacker can influence the configuration inputs of a service using this library, they can force the client to request an unlimited volume of messages from the broker. This overrides intended application-level rate limiting, causing rapid heap memory growth and potential Out-Of-Memory (OOM) termination of the consumer service.

Attack Chain

1. An attacker identifies a service that utilizes the amqp091-go library for message consumption.
2. The attacker gains access to modify application configuration files, environment variables, or specific API parameters that control the client's Qos settings.
3. The attacker sets the prefetchCount or prefetchSize parameter to -1.
4. The application logic initializes the AMQP channel and calls Qos with the attacker-controlled input.
5. The library executes a silent implicit cast from int to uint (e.g., uint16(-1) becomes 65535).
6. The client sends a frame to the RabbitMQ broker requesting an effectively unlimited message delivery rate.
7. The broker flushes queued messages into the client's network buffer, bypassing concurrency limits.
8. The consumer application experiences a spike in heap memory usage and crashes due to OOM.

Impact

Successful exploitation results in an application-layer Denial of Service (DoS) for the targeted service. By inducing an OOM condition, attackers can disrupt message processing workflows, potentially leading to service unavailability and operational impact. This vulnerability affects any environment relying on amqp091-go for high-throughput message processing.

Recommendation

1. Upgrade the amqp091-go dependency to version 1.13.0 or later immediately to incorporate input validation that prevents unsafe casting.
2. Perform an audit of application codebases that implement the Qos method to ensure no user-provided input or configuration values can supply negative integers to these parameters.
3. Implement strict input validation or sanitization layers before passing configuration data to library methods.