A AegiFlow
HIGHCVSS 8.7EPSS 0.1%

CVE-2026-77404

CVE-2026-77404 updated by NVD

Published
2026-09-17
Modified
2026-09-18
EPSS percentile
1%
Sources
github-advisory, nvd

Summary

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AMQPS query string instead of encoding them as URL query parameters with url.Values. If an application accepts a TLS asset path containing ampersand or equals delimiters and later reparses the serialized URI with ParseURI, the embedded delimiters can create or overwrite connection options, including paths to TLS certificate, key, or CA files. This can corrupt connection configuration or select unintended local cryptographic assets. This issue is fixed in version 1.13.0.

Affected packages

EcosystemPackageAffected versionsFixed versions
Gogithub.com/rabbitmq/amqp091-go1.13.0

Remediation: Upgrade to 1.13.0 or later.

References

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.