RabbitMQ amqp091-go versions before 1.13.0 have an improper encoding vulnerability (CWE-116) in the URI.String method in uri.go. This method concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into the AMQPS URI query string without encoding them as URL query parameters. If an attacker supplies TLS asset paths containing ampersand (&) or equals (=) characters, these delimiters can be interpreted as additional or overwritten query parameters when the URI is reparsed with ParseURI. This can lead to corruption of connection configuration or selection of unintended local TLS certificate, key, or CA files. The vulnerability is addressed by properly encoding these values in version 1.13.0.

An attacker with the ability to influence TLS asset paths can manipulate the AMQPS URI query string to alter connection options, potentially causing the client to use unintended cryptographic assets or corrupt connection configuration. This can compromise the security of the TLS connection setup, leading to high confidentiality, integrity, and availability impacts on the connection.

Upgrade to RabbitMQ amqp091-go version 1.13.0 or later, where this issue is fixed by proper URL encoding of TLS asset paths in the URI.String method. No other mitigations are indicated.