Live › vulnerability › CVE-2026-77405
Go to dashboardThe amqp091-go Go client builds TLS configs for amqps:// URIs without a minimum TLS version, so on Go runtimes whose default allows TLS 1.0 or 1.1 the connection can fall back to those obsolete protocols. A network attacker able to influence the TLS handshake could weaken protection of AMQP messages and credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/rabbitmq/amqp091-go | go | < 1.13.0 | 1.13.0 |
1.13.01.13.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-77405")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.