AMQP 0.9.1 Client Vulnerability in RabbitMQ
CVE-2026-77404

8.7HIGH

Key Information:

Vendor

RabbitMQ

Status
AMQp091-go
Vendor
CVE Published:
16 September 2026

What is CVE-2026-77404?

The RabbitMQ amqp091-go client for Go experienced a vulnerability related to URI string handling prior to version 1.13.0. When constructing an AMQPS query string, critical components such as CertFile, KeyFile, CACertFile, and ServerName values were concatenated directly, instead of being URL-encoded as query parameters. This flaw allowed an application to mishandle TLS asset paths that included ampersand or equals characters, potentially leading to corrupted connection configurations. This may inadvertently select incorrect local cryptographic assets or create malformed connection options. The issue has been resolved in version 1.13.0.

Affected Version(s)

amqp091-go < 1.13.0

References

https://github.com/rabbitmq/amqp091-go/security/advisorie...
x_refsource_CONFIRM
https://github.com/rabbitmq/amqp091-go/pull/352
x_refsource_MISC
https://github.com/rabbitmq/amqp091-go/commit/743d488e469...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.