RabbitMQ amqp091-go up to 1.12.x uri.go tlsConfigFromURI risky encryption

Summaryinfo

A vulnerability identified as problematic has been detected in RabbitMQ amqp091-go up to 1.12.x. Affected by this issue is the function tlsConfigFromURI of the file uri.go. This manipulation causes risky encryption. This vulnerability is tracked as CVE-2026-77405. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in RabbitMQ amqp091-go up to 1.12.x and classified as problematic. Affected by this vulnerability is the function tlsConfigFromURI of the file uri.go. The manipulation with an unknown input leads to a risky encryption vulnerability. The CWE definition for the vulnerability is CWE-327. The product uses a broken or risky cryptographic algorithm or protocol. As an impact it is known to affect confidentiality. The summary by CVE is:

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-77405 since 08/20/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

Upgrading to version 1.13.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• RabbitMQ

Name

• amqp091-go

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12

Website

• Product: https://github.com/rabbitmq/amqp091-go/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion