Affected: CleanStart: opentelemetry-collector-contrib
Security vulnerability affects the opentelemetry-collector-contrib package. RabbitMQ amqp091-go is a Go AMQP 0.
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, the writeShortstr function in write.go casts the byte length of AMQP shortstr property values to uint8 without first rejecting values longer than 255 bytes. An application that accepts an oversized CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type value can therefore serialize a wrapped length and only a truncated prefix, while reporting no error. The resulting silent metadata corruption can break request and reply correlation, routing, tracing, and downstream message processing. This issue is fixed in version 1.13.0.
Affected: Go: github.com/rabbitmq/amqp091-go
## Summary A data integrity and protocol corruption vulnerability exists in the AMQP client's property serialization logic. When encoding AMQP short string (`shortstr`) fields—such as identifiers, routing strings, and content metadata—the length of the string is explicitly cast to a fixed-size 8-bit unsigned integer (`uint8`).
If an application provides a property string exceeding 255 bytes, the length counter silently wraps around (e.g., a length of 300 wraps to 44). As a result, the parser writes only a truncated portion of the string into the outgoing connection buffer without returning an error. This leads to silent data corruption, broken RPC routing, and unpredictable broker-side state behavior.
---
## Vulnerability Details
### Mechanism The vulnerability resides in the wire-level serialization logic for application publishing properties:
```go // write.go:246 length := uint8(len(b)) // wraps silently when len(b) > 255 (e.g., 300 -> 44) ```
Because Go allows silent integer truncation during explicit type casting, lengths larger than $2^8 - 1$ lose their most significant bits. The underlying stream writer reads `length` to determine how many bytes to pull from the buffer. Because no error or boundary check accompanies this truncation, the application believes the full payload was transmitted successfully.
### Affected Properties This truncation behavior affects every standard AMQP field serialized as a `shortstr`: * `CorrelationId` * `ReplyTo` * `MessageId` * `…