CVE-2026-77409

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0

Description The Channel.dispatch function in channel.go, confirms.confirm in confirms.go, and Connection.dispatch0 in connection.go synchronously send publisher confirmations, flow-control events, consumer cancellations, and returned messages (including NotifyConfirm events and connection block notifications) to application-provided channels. If a listener channel is unbuffered, full, or not drained promptly, the sole reader goroutine blocks and stops processing frames, acknowledgments, deliveries, and heartbeats. This can lead to connection stalls, missed heartbeats, deadlocks, and disconnection during broker-driven event bursts.

Recommendations Update to version 1.13.0.