REDHAT-BUG-2535502: High severity go/github.com/rabbitmq/amqp091-go vulnerability

Q: Which deployments are affected?

Deployments using amqp091-go before version 1.13.0 that connect through an amqps URI may be affected if their Go runtime permits TLS 1.0 or TLS 1.1 by default.

Q: What does an attacker need to exploit this issue?

An attacker must be able to influence TLS negotiation between the client and the AMQP service. Under the affected runtime conditions, this can result in negotiation of an obsolete TLS protocol version.

Q: How can I determine whether my application is exposed?

Check whether the application uses amqp091-go versions earlier than 1.13.0 and establishes connections with amqps URIs. Exposure additionally depends on whether the Go runtime's default TLS settings allow TLS 1.0 or TLS 1.1.

Q: What version resolves the issue?

The issue is fixed in amqp091-go version 1.13.0.

Published Sep 16, 2026

Updated

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.

Affected Software

1 affected component

go/github.com/rabbitmq/amqp091-go<1.13.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade RabbitMQ amqp091-go to a version that resolves this vulnerability.
Fixed in 1.13.0

Event History

Sep 16, 2026

Data Sourced

via Red Hat·02:55 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are affected?

Deployments using amqp091-go before version 1.13.0 that connect through an amqps URI may be affected if their Go runtime permits TLS 1.0 or TLS 1.1 by default.

What does an attacker need to exploit this issue?

An attacker must be able to influence TLS negotiation between the client and the AMQP service. Under the affected runtime conditions, this can result in negotiation of an obsolete TLS protocol version.

How can I determine whether my application is exposed?

Check whether the application uses amqp091-go versions earlier than 1.13.0 and establishes connections with amqps URIs. Exposure additionally depends on whether the Go runtime's default TLS settings allow TLS 1.0 or TLS 1.1.

What version resolves the issue?

The issue is fixed in amqp091-go version 1.13.0.

REDHAT-BUG-2535502: High severity go/github.com/rabbitmq/amqp091-go vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

How can I determine whether my application is exposed?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

How can I determine whether my application is exposed?

What version resolves the issue?