Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-16T14:40:49 github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Connection configuration overwrite via unsanitized TLS path parameter injection 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE-140

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AMQPS query string instead of encoding them as URL query parameters with url.Values. If an application accepts a TLS asset path containing ampersand or equals delimiters and later reparses the serialized URI with ParseURI, the embedded delimiters can create or overwrite connection options, including paths to TLS certificate, key, or CA files. This can corrupt connection configuration or select unintended local cryptographic assets. This issue is fixed in version 1.13.0.

A flaw was found in RabbitMQ amqp091-go. The URI.String function in uri.go concatenates TLS asset path values directly into an AMQPS query string without proper encoding. If an application processes a TLS asset path containing special characters like ampersand or equals delimiters, these can be misinterpreted during URI re-parsing. This vulnerability could allow an attacker to overwrite connection options, potentially corrupting the connection configuration or selecting unintended local cryptographic assets, leading to a compromise of the TLS connection.

This flaw has an Important impact because applications in Red Hat products that use amqp091-go and accept attacker-controlled TLS asset paths can be induced to reparse a crafted AMQPS URI. A local attacker with partial control of a certificate, key, CA, or server-name path or related environment setting can inject query parameters and alter connection configuration, potentially selecting unintended local TLS material or causing connection failures. Avoid accepting untrusted values for TLS certificate, key, CA, or server-name paths. Restrict write access to directories and environment settings used to configure those paths, and upgrade applications using amqp091-go to version 1.13.0 or later when available. Red Hat Hardened Images 2026-09-16T00:00:00Z RHSA-2026:68290 opentelemetry-collector-contrib-main-0.161.0-0.1.hum1 Cryostat 4 Not affected cryostat/cryostat-storage-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9 Custom Metric Autoscaler operator for Red Hat Openshift Not affected custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator Multicluster Global Hub Affected multicluster-globalhub/multicluster-globalhub-grafana-rhel9 OpenShift Serverless Affected openshift-serverless-1/kn-plugin-event-sender-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Affected rhacm2/acm-grafana-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/volsync-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 Not affected rhacm2/volsync-rhel9 Red Hat OpenStack Platform 18.0 Affected rhoso-operators/rabbitmq-cluster-rhel9-operator Red Hat Quay 3 Affected quay/clair-rhel8 Red Hat Quay 3 Affected quay/clair-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-77404 https://nvd.nist.gov/vuln/detail/CVE-2026-77404 https://github.com/rabbitmq/amqp091-go/commit/743d488e46955fe7ffc55506fe2c401d01216783 https://github.com/rabbitmq/amqp091-go/pull/352 https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0 https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-465g-fh3v-9jw4