CVE-2026-77404 in amqp091-go
Summary
by MITRE • 09/16/2026
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AMQPS query string instead of encoding them as URL query parameters with url.Values. If an application accepts a TLS asset path containing ampersand or equals delimiters and later reparses the serialized URI with ParseURI, the embedded delimiters can create or overwrite connection options, including paths to TLS certificate, key, or CA files. This can corrupt connection configuration or select unintended local cryptographic assets. This issue is fixed in version 1.13.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in RabbitMQ's amqp091-go client library prior to version 1.13.0 represents a critical input validation and encoding flaw within the URI handling logic, specifically affecting the serialization of AMQPS connection strings. The core technical deficiency lies in the implementation of the String method for URIs containing TLS configuration parameters such as CertFile, KeyFile, CACertFile, and ServerName. Instead of properly escaping these values using standard URL query parameter encoding mechanisms provided by Go's url.Values package, the library performs direct string concatenation to construct the final URI. This approach fails to account for special characters that hold semantic meaning in Uniform Resource Identifier structures, particularly ampersands used as delimiters between parameters and equals signs used to separate keys from values within those parameters.
When an application accepts a TLS asset path or configuration value containing these delimiter characters, such as a file path like /etc/ssl/cert.pem?query=value, the lack of encoding causes the embedded symbols to be interpreted by subsequent parsing routines rather than treated as literal data components. Upon serialization, these unescaped delimiters become part of the query string structure itself. Consequently, when the serialized URI is later reparsed using the ParseURI function, the parser interprets the characters within the file paths as structural elements of the connection configuration. This misinterpretation allows an attacker or a malformed input source to inject additional parameters into the connection request that were not originally intended by the application developer.
The operational impact of this flaw is severe, primarily centering on the potential for connection configuration corruption and unauthorized selection of cryptographic assets. By injecting ampersands or equals signs within file paths, it becomes possible to overwrite existing TLS settings or introduce new ones entirely. For instance, an attacker could potentially redirect the client to load a malicious certificate authority file from a different location by appending parameters that override the CACertFile setting. This manipulation can lead to man-in-the-middle attacks if the application proceeds with a connection using compromised cryptographic material, thereby undermining the confidentiality and integrity of communications established through RabbitMQ. The vulnerability effectively allows for configuration injection via URI parsing inconsistencies, which is classified under CWE-20 as Improper Input Validation and aligns with ATT&CK techniques related to command or script injection where input data influences system behavior in unintended ways.
Mitigation strategies require immediate upgrading to version 1.13.0 of the amqp091-go library, where this encoding issue has been resolved by implementing proper URL query parameter escaping for all TLS-related fields. For applications unable to upgrade immediately, developers should implement strict input validation on any file paths or configuration values passed into URI construction functions, ensuring that special characters like ampersands and equals signs are either rejected or manually encoded before being processed by the library. Additionally, auditing existing codebases for direct string concatenation in URL building operations is recommended to prevent similar vulnerabilities across other components of the system.