{"id":"CVE-2026-77405","aliases":["AZL-103182","AZL-103284","DEBIAN-CVE-2026-77405","EUVD-2026-80818","GHSA-33mj-cw25-m34h","GO-2026-6492","ROOT-APP-GOBINARY-CVE-2026-77405","UBUNTU-CVE-2026-77405"],"status":"published","title":"RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.","severity":{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00282,"percentile":0.20929,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-316","CWE-326"],"published":"2026-09-16T14:42:08Z","modified":"2026-11-02T14:15:30Z","fixes":[{"ecosystem":"Go","package":"github.com/rabbitmq/amqp091-go","fixed_in":["1.13.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"telegraf","fixed_in":["1.31.0-34"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-rabbitmq-amqp091-go","fixed_in":["1.14.0-1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"github.com/rabbitmq/amqp091-go","fixed_in":["v1.10.0-aikido.4","v1.10.0-aikido.5","v1.10.0-aikido.6","v1.10.0-aikido.7","v1.12.0-aikido.5","v1.12.0-aikido.6","v1.11.0-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Go","package":"rootio-github.com/rabbitmq/amqp091-go","fixed_in":["v1.10.0-root.io.4","v1.10.0-root.io.5","v1.10.0-root.io.6","v1.10.0-root.io.7","v1.12.0-root.io.5","v1.12.0-root.io.6","v1.11.0-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/rabbitmq/amqp091-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"keda","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.14.1-19"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"telegraf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.0-34"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-rabbitmq-amqp091-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.0-1","1.11.0-1","1.12.0-1","1.14.0-1","1.15.0-1","1.5.0-2","1.8.1-1","1.8.1-2","1.9.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-rabbitmq-amqp091-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.0-1","1.11.0-1","1.12.0-1","1.14.0-1","1.15.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-rabbitmq-amqp091-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1"}]}],"versions":["1.10.0-1","1.11.0-1","1.12.0-1"]},{"source":"osv","ecosystem":"Go","package":"github.com/rabbitmq/amqp091-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/rabbitmq/amqp091-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.13.0"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"github.com/rabbitmq/amqp091-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.10.0-aikido.4"},{"fixed":"v1.10.0-aikido.5"},{"fixed":"v1.10.0-aikido.6"},{"fixed":"v1.10.0-aikido.7"},{"fixed":"v1.12.0-aikido.5"},{"fixed":"v1.12.0-aikido.6"},{"fixed":"v1.11.0-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Go","package":"rootio-github.com/rabbitmq/amqp091-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v1.10.0-root.io.4"},{"fixed":"v1.10.0-root.io.5"},{"fixed":"v1.10.0-root.io.6"},{"fixed":"v1.10.0-root.io.7"},{"fixed":"v1.12.0-root.io.5"},{"fixed":"v1.12.0-root.io.6"},{"fixed":"v1.11.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-rabbitmq-amqp091-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-2","1.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"golang-github-rabbitmq-amqp091-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.0-1","1.11.0-1","1.12.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"golang-github-rabbitmq-amqp091-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.0-1"]}],"products":[{"vendor":"rabbitmq","product":"amqp091-go"}],"references":[{"url":"https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-33mj-cw25-m34h","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/rabbitmq/amqp091-go/pull/355","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/rabbitmq/amqp091-go/commit/c9fd433ecac2e557919e51acc9d809390c402c6e","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77405","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-33mj-cw25-m34h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77405.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-77405","tags":["advisory"]},{"url":"https://github.com/rabbitmq/amqp091-go","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-77405","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77405","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-77405","title":"RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.","status":"published","published":"2026-09-16T14:42:08.67Z","modified":"2026-09-18T17:59:20.584Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:20:16.072351Z"}],"euvd":[{"id":"EUVD-2026-80818","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.","status":"published","published":"2026-09-16T14:42:08Z","modified":"2026-09-18T17:59:20Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N","level":"critical"}],"updated_at":"2026-11-02T17:28:07.943492Z"}],"ghsa":[{"id":"GHSA-33mj-cw25-m34h","title":"RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser","description":"## Summary\nA structural security weakness exists in the AMQP client's TLS configuration generator (`tlsConfigFromURI`). When constructing a `*tls.Config` object from an `amqps://` connection URI, the library initializes the structure without explicitly defining the `MinVersion` field. \n\nWhile modern versions of the Go compiler toolchain (Go 1.18+) default the implicit minimum version to TLS 1.2, this security posture relies entirely on an implicit toolchain dependency. If the library is compiled using legacy Go toolchains (Go \u003c 1.18), or if a future toolchain introduces fallback behavior, the client could silently negotiate obsolete and insecure TLS 1.0 or TLS 1.1 protocols during connection handshakes with a compromised or malicious AMQP broker.\n\n---\n\n## Vulnerability Details\n\n### Mechanism\nThe vulnerability lies in the lack of an explicit safety floor when assigning configurations inside the URI component:\n\n```go\n// Example within uri.go's tlsConfigFromURI\ncfg := \u0026tls.Config{\n    ServerName: host,\n    // MinVersion is left completely unassigned (defaults to 0, or toolchain default)\n}\n```\n\nIn the Go standard library (`crypto/tls`), leaving `MinVersion: 0` instructs the runtime to choose the toolchain's default minimum. Prior to Go 1.18, this default allowed negotiation down to TLS 1.0. Relying on implicit compiler configurations violates secure coding practices by decoupling the library's security posture from its source code, leaving applications vulnerable based solely on how they are built.\n\n### Impact\nIf a client application is built with a legacy compiler environment or a custom Go runtime, an attacker capable of executing a Man-in-the-Middle (MitM) attack can force the connection to downgrade to TLS 1.0 or 1.1. This exposes the AMQP protocol data stream to well-known cryptographic vulnerabilities (such as BEAST, POODLE, or SWEET32), allowing the attacker to decrypt or alter message payloads, connection parameters, and authentication credentials.\n\n---\n\n## Attack Vector\nAn attacker performing a network-level downgrade attack can intercept a client connection built under a legacy toolchain:\n\n1. **Interception:** A client application compiled on a legacy pipeline attempts to establish an encrypted connection to an AMQP broker.\n2. **Protocol Downgrade:** The attacker intercepts the TLS Client Hello handshake and forces a downgrade negotiation to TLS 1.0.\n3. **Cryptographic Exploitation:** Because `MinVersion` was never explicitly locked to `tls.VersionTLS12` by the library, the client accepts the weak cipher suites, allowing the attacker to monitor or manipulate the underlying AMQP session data.","status":"published","published":"2026-09-17T17:04:01Z","modified":"2026-09-17T17:04:02Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N","level":"critical"}],"cwes":["CWE-316","CWE-326"],"updated_at":"2026-11-02T14:41:18.357514Z"}],"nvd":[{"id":"CVE-2026-77405","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.","status":"published","published":"2026-09-16T15:17:47.98Z","modified":"2026-09-24T21:16:28.12Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:12:48.630594Z"}],"osv":[{"id":"CVE-2026-77405","title":"RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.","status":"published","published":"2026-09-16T14:42:08.67Z","modified":"2026-10-28T02:31:01.71044658Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N","level":"critical"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"DEBIAN-CVE-2026-77405","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.","status":"published","published":"2026-09-16T15:17:47.98Z","modified":"2026-09-25T08:47:23.300557281Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"GHSA-33mj-cw25-m34h","title":"RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser","description":"## Summary\nA structural security weakness exists in the AMQP client's TLS configuration generator (`tlsConfigFromURI`). When constructing a `*tls.Config` object from an `amqps://` connection URI, the library initializes the structure without explicitly defining the `MinVersion` field. \n\nWhile modern versions of the Go compiler toolchain (Go 1.18+) default the implicit minimum version to TLS 1.2, this security posture relies entirely on an implicit toolchain dependency. If the library is compiled using legacy Go toolchains (Go \u003c 1.18), or if a future toolchain introduces fallback behavior, the client could silently negotiate obsolete and insecure TLS 1.0 or TLS 1.1 protocols during connection handshakes with a compromised or malicious AMQP broker.\n\n---\n\n## Vulnerability Details\n\n### Mechanism\nThe vulnerability lies in the lack of an explicit safety floor when assigning configurations inside the URI component:\n\n```go\n// Example within uri.go's tlsConfigFromURI\ncfg := \u0026tls.Config{\n    ServerName: host,\n    // MinVersion is left completely unassigned (defaults to 0, or toolchain default)\n}\n```\n\nIn the Go standard library (`crypto/tls`), leaving `MinVersion: 0` instructs the runtime to choose the toolchain's default minimum. Prior to Go 1.18, this default allowed negotiation down to TLS 1.0. Relying on implicit compiler configurations violates secure coding practices by decoupling the library's security posture from its source code, leaving applications vulnerable based solely on how they are built.\n\n### Impact\nIf a client application is built with a legacy compiler environment or a custom Go runtime, an attacker capable of executing a Man-in-the-Middle (MitM) attack can force the connection to downgrade to TLS 1.0 or 1.1. This exposes the AMQP protocol data stream to well-known cryptographic vulnerabilities (such as BEAST, POODLE, or SWEET32), allowing the attacker to decrypt or alter message payloads, connection parameters, and authentication credentials.\n\n---\n\n## Attack Vector\nAn attacker performing a network-level downgrade attack can intercept a client connection built under a legacy toolchain:\n\n1. **Interception:** A client application compiled on a legacy pipeline attempts to establish an encrypted connection to an AMQP broker.\n2. **Protocol Downgrade:** The attacker intercepts the TLS Client Hello handshake and forces a downgrade negotiation to TLS 1.0.\n3. **Cryptographic Exploitation:** Because `MinVersion` was never explicitly locked to `tls.VersionTLS12` by the library, the client accepts the weak cipher suites, allowing the attacker to monitor or manipulate the underlying AMQP session data.","status":"published","published":"2026-09-17T17:04:01Z","modified":"2026-10-01T20:56:07.689506743Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N","level":"critical"}],"cwes":["CWE-316","CWE-326"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"UBUNTU-CVE-2026-77405","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.","status":"published","published":"2026-09-16T15:17:00Z","modified":"2026-10-28T20:17:23.996820633Z","cvss":[{"version":"4.0","score":9.4,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N","level":"critical"}],"updated_at":"2026-11-02T16:57:18.015985Z"},{"id":"AZL-103182","title":"CVE-2026-77405 affecting package keda 2.14.1-19","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.","status":"published","published":"2026-09-16T15:17:47Z","modified":"2026-10-31T05:32:45Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"AZL-103284","title":"CVE-2026-77405 affecting package telegraf for versions less than 1.31.0-34","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.","status":"published","published":"2026-09-16T15:17:47Z","modified":"2026-11-02T14:15:30.927998488Z","updated_at":"2026-11-02T15:28:00.794214Z"},{"id":"GO-2026-6492","title":"RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser in github.com/rabbitmq/amqp091-go","description":"RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser in github.com/rabbitmq/amqp091-go","status":"published","published":"2026-10-01T20:23:56Z","modified":"2026-10-01T20:45:11.303878798Z","updated_at":"2026-11-02T15:47:03.11707Z"},{"id":"ROOT-APP-GOBINARY-CVE-2026-77405","title":"CVE-2026-77405 in github.com/rabbitmq/amqp091-go - Patched by Root","description":"Root has patched CVE-2026-77405 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available.","status":"published","published":"2026-10-20T12:55:23Z","modified":"2026-10-20T13:15:04.037715941Z","updated_at":"2026-11-02T15:53:26.76659Z"}]}}