CVE-2026-77405: RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
amqp091-goto a version that resolves this vulnerability.Fixed in 1.13.0 - Configuration
Ensure the AMQPS URI parser sets tls.Config.MinVersion to tls.VersionTLS12 (in versions prior to 1.13.0, MinVersion was not set).
amqp091-go (tlsConfigFromURI in uri.go) tls.Config MinVersion = tls.VersionTLS12
Event History
Frequently Asked Questions
Which deployments are exposed to obsolete TLS negotiation?
Deployments using amqp091-go versions before 1.13.0 are affected when they connect using an amqps URI and run on a Go runtime whose default TLS configuration still permits TLS 1.0 or TLS 1.1.
What must an attacker be able to do to exploit this issue?
An attacker must be able to influence TLS negotiation between the client and the AMQP endpoint. Under the affected conditions, this can cause negotiation of an obsolete TLS protocol version and weaken protection for AMQP messages and credentials.
How can the issue be remediated?
Upgrade amqp091-go to version 1.13.0, which sets the TLS minimum version to TLS 1.2 when creating TLS configuration from an amqps URI.