Detections
Analytics
Echo: github.com/rabbitmq/amqp091-go: security update to 1.13.0
critical Tenable Self-Hosted Container Security Plugin ID 460154
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, readLongstr in read.go returns an empty
string and a nil error when a declared AMQP longstr length exceeds 0x7FFFFFFF instead of returning
ErrSyntax. The function leaves the declared field bytes unread, while readTable treats the operation as
successful and continues parsing from the wrong offset. A malicious or compromised broker can provide an
oversized longstr in a table field and desynchronize subsequent AMQP parsing, causing attacker-controlled
trailing bytes to be interpreted as later fields or frames and disrupting connection integrity and
availability. This issue is fixed in version 1.13.0. (CVE-2026-77411)
Solution
Update the github.com/rabbitmq/amqp091-go library and its related packages to version 1.13.0 or later.See Also
Plugin Details
Severity: Critical
ID: 460154
Version: Revision 1.2
Type: Local
Family: Echo Local Security Checks
Published: 10/2/2026
Updated: 10/5/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7.6
Percentile: 98.3
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2026-77411
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 9.5
Threat Score: 9.5
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 9/28/2026
Vulnerability Publication Date: 9/16/2026
Reference Information
CVE: CVE-2026-77411