EUVD-2026-80817Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Config data-flow needing an untrusted path plus a non-default serialize/reparse round-trip supports AV:L/PR:L; impact is chiefly integrity of connection config (I:H) with only indirect confidentiality/availability (C:L/A:L).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AMQPS query string instead of encoding them as URL query parameters with url.Values. If an application accepts a TLS asset path containing ampersand or equals delimiters and later reparses the serialized URI with ParseURI, the embedded delimiters can create or overwrite connection options, including paths to TLS certificate, key, or CA files. This can corrupt connection configuration or select unintended local cryptographic assets. This issue is fixed in version 1.13.0.
AnalysisAI
Improper output encoding in the RabbitMQ amqp091-go Go client before 1.13.0 lets an attacker who can influence a TLS asset path value (CertFile, KeyFile, CACertFile, or ServerName) inject or overwrite AMQPS connection options whenever an application serializes a URI with URI.String() and later reparses it with ParseURI(). Because the values are concatenated into the query string without url.Values encoding, embedded '&' and '=' delimiters split into extra parameters that can redirect the client to different - but still pre-existing - local certificate, key, or CA files, corrupting connection configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an application using amqp091-go before 1.13.0 that (1) accepts a TLS asset path value - CertFile, KeyFile, CACertFile, or ServerName - containing '&' or '=' delimiter characters from an untrusted or attacker-influenceable source, and (2) serializes the AMQPS URI via URI.String() and then re-parses the serialized form with ParseURI() (a round-trip). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate-severity data-handling flaw whose real-world risk is well below its headline 8.7 CVSS 4.0 score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later, which switches URI.String() to url.Values encoding and adds a round-trip regression test; rebuild and redeploy any Go binary that links the library, since this is a library fix baked into the application rather than a broker-side change. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all applications using the RabbitMQ amqp091-go client and identify any versions prior to 1.13.0; immediately apply the vendor-released patch version 1.13.0 where feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed UR
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query p
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today