CVE-2026-77404highCWE-116

CVE-2026-77404: high-severity vulnerability in rabbitmq amqp091-go

RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection

Published

Follow this CVE+ Monitor amqp091-go+ Monitor golang-github-rabbitmq-amqp091-go

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.1%
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AMQPS query string instead of encoding them as URL query parameters with url.Values. If an application accepts a TLS asset path containing ampersand or equals delimiters and later reparses the serialized URI with ParseURI, the embedded delimiters can create or overwrite connection options, including paths to TLS certificate, key, or CA files. This can corrupt connection configuration or select unintended local cryptographic assets. This issue is fixed in version 1.13.0.
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
Affected products
rabbitmq · amqp091-go
Related CVEs — rabbitmq amqp091-go

In the same product, most dangerous first.

CVE-2026-79921HIGHamqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized PayloadEPSS 0.5%CVE-2026-77409HIGHRabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel BlockingEPSS 0.5%CVE-2026-77411CRITICALRabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstrEPSS 0.5%CVE-2026-77412HIGHRabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP ClientEPSS 0.5%CVE-2026-77410HIGHRabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer AllocationEPSS 0.5%CVE-2026-77406HIGHRabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos ConfigurationEPSS 0.5%