CVE-2026-77405 in amqp091-go
Summary
by MITRE • 09/16/2026
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The RabbitMQ Go client library, specifically the amqp091-go package used for implementing AMQP 0.9.1 protocol connections, contained a critical configuration flaw in its TLS handling logic prior to version 1.13.0. The vulnerability resides within the tlsConfigFromURI function located in uri.go, which is responsible for constructing Transport Layer Security configurations based on provided Uniform Resource Identifiers. When establishing secure connections via amqps URIs, this function failed to explicitly set the MinVersion field of the resulting tls.Config structure. In Go programming language environments where the default TLS minimum version was not hardcoded to 1.2 or higher, such as older runtime versions or specific build configurations, this omission resulted in the client accepting legacy protocol versions including TLS 1.0 and TLS 1.1 during the handshake process. This behavior contradicts modern security best practices which mandate a baseline of TLS 1.2 for all encrypted communications to ensure adequate cryptographic strength.
From an operational perspective, this misconfiguration exposes systems utilizing affected versions of the RabbitMQ Go client to significant risks associated with deprecated transport protocols. TLS 1.0 and TLS 1.1 have known vulnerabilities such as BEAST, POODLE, and other cipher suite weaknesses that can be exploited by adversaries capable of performing man-in-the-middle attacks or network traffic interception. An attacker positioned within the network path between the client application and the RabbitMQ broker could potentially downgrade the connection to these weaker protocol versions if they are supported by both ends of the communication channel. Once a legacy version is negotiated, the confidentiality and integrity of AMQP messages and authentication credentials transmitted over the wire may be compromised through cryptographic attacks or passive eavesdropping techniques that exploit known flaws in older cipher suites.
This vulnerability aligns with CWE-326, which describes insufficient encryption strength, as well as CWE-942, concerning permission issues allowing access to sensitive information via insecure protocols. In terms of the MITRE ATT&CK framework, this flaw facilitates Network Sniffing and Protocol Downgrade attacks under techniques such as T1048 (Exfiltration Over Alternative Protocol) or potentially enabling credential theft if session hijacking is achieved through weakened encryption. The impact extends beyond mere data exposure; it undermines the trust model of message queuing systems where reliable, secure delivery is paramount for enterprise applications handling sensitive business logic and user data.
The resolution to this issue was implemented in version 1.13.0 of the amqp091-go library by explicitly setting MinVersion to tls.VersionTLS12 within the configuration generation process. This ensures that regardless of the underlying Go runtime defaults, the client will refuse connections attempting to use TLS versions older than 1.2. Organizations and developers relying on this library must upgrade to version 1.13.0 or later immediately to mitigate these risks. Additionally, it is recommended to audit server-side configurations to ensure they also enforce a minimum of TLS 1.2, thereby creating a defense-in-depth posture that prevents protocol downgrading even if client defaults were previously permissive. Regular updates of dependency libraries and adherence to current cryptographic standards are essential practices for maintaining robust security in distributed messaging architectures.