GO · SEPTEMBER 2026 · EARLY WARNING

AMQP Client URI Vulnerability in amqp091-go: Early Warning

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
rabbitmq (go)
Patched version
Not yet available
GHSA-465G-FH3V-9JW4

An early warning has been issued for a query parameter injection vulnerability in the AMQP client's connection URI formatting logic. This vulnerability affects the amqp091-go package.

What happened

An early warning has been issued for a query parameter injection vulnerability in the AMQP client's connection URI formatting logic. This vulnerability exists because TLS-related filesystem paths are appended directly to the URI's query string using string concatenation rather than secure URL encoding. This could allow an attacker to inject malicious parameters into the connection configuration.

The affected component is the amqp091-go package, specifically versions prior to 1.13.0. No authoritative version range for the rabbitmq (go) component has been published yet. It is recommended to upgrade to the latest version of amqp091-go and ensure that TLS file paths do not contain special characters that could be misinterpreted as parameter separators.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If rabbitmq is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using the amqp091-go package in versions prior to 1.13.0. The impact on the rabbitmq (go) component is under investigation.

What should I do right now?

Upgrade to the latest version of amqp091-go and ensure that TLS file paths do not contain special characters that could be misinterpreted as parameter separators. Monitor the primary sources for updates on this vulnerability.

Has this been exploited in the wild?

No, this vulnerability has not been reported as exploited in the wild.

Sources

Join the 0Day waitlist →

← Back to all threats