TLS Configuration Vulnerability in RabbitMQ AMQP Client
CVE-2026-77405

9.4CRITICAL

Key Information:

Vendor

RabbitMQ

Status
AMQp091-go
Vendor
CVE Published:
16 September 2026

What is CVE-2026-77405?

The RabbitMQ AMQP 0.9.1 client, amqp091-go, exhibits a vulnerability where the TLS configuration does not enforce a minimum version of TLS 1.2. This oversight allows builds utilizing a Go runtime with defaults permitting older TLS versions (1.0 or 1.1) to potentially negotiate weaker security protocols during connections established with an amqps URI. If a network attacker manipulates the TLS negotiation in such instances, it could compromise the integrity and confidentiality of AMQP messages and credentials. This vulnerability is addressed in version 1.13.0.

Affected Version(s)

amqp091-go < 1.13.0

References

https://github.com/rabbitmq/amqp091-go/security/advisorie...
x_refsource_CONFIRM
https://github.com/rabbitmq/amqp091-go/pull/355
x_refsource_MISC
https://github.com/rabbitmq/amqp091-go/commit/c9fd433ecac...
x_refsource_MISC

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.