CVE-2026-77405
Published:September 16, 2026
Updated:September 22, 2026
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.
Affected Packages
https://github.com/rabbitmq/amqp091-go.git (GITHUB):
Affected version(s) >=v1.1.0 <v1.13.0Fix Suggestion:
Update to version v1.13.0github.com/rabbitmq/amqp091-go (GO):
Affected version(s) >=a1a3ba3c77697420d7055371d5c5c6bd1f0e3d66 <v1.13.0Fix Suggestion:
Update to version v1.13.0github.com/rabbitmq/amqp091-go (GO):
Affected version(s) >=v1.1.0 <v1.13.0Fix Suggestion:
Update to version v1.13.0Related Resources (6)
Do you need more information?
Contact UsCVSS v4
Base Score:
9.4
Attack Vector
NETWORK
Attack Complexity
HIGH
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
LOW
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.7
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Weakness Type (CWE)
EPSS
Base Score:
0.23