Critical severityNVD Advisory· Published Sep 16, 2026· Updated Sep 24, 2026
CVE-2026-77405
CVE-2026-77405
Description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/rabbitmq/amqp091-goGo | < 1.13.0 | 1.13.0 |
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <1.13.0
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-33mj-cw25-m34hghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-77405ghsaADVISORY
- github.com/rabbitmq/amqp091-go/commit/c9fd433ecac2e557919e51acc9d809390c402c6envdWEB
- github.com/rabbitmq/amqp091-go/pull/355nvdWEB
- github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0nvdWEB
- github.com/rabbitmq/amqp091-go/security/advisories/GHSA-33mj-cw25-m34hnvdWEB
News mentions
0No linked articles in our index yet.