CVE-2026-77405: critical vulnerability in rabbitmq amqp091-go
RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.4epss 0.3%
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when connecting through an amqps URI. A network attacker able to influence TLS negotiation with such a legacy build may weaken transport protection for AMQP messages and credentials. This issue is fixed in version 1.13.0.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:L/SA:N
Affected products
rabbitmq · amqp091-goRelated CVEs — rabbitmq amqp091-go
In the same product, most dangerous first.
CVE-2026-79921HIGHamqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized PayloadEPSS 0.5%CVE-2026-77409HIGHRabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel BlockingEPSS 0.5%CVE-2026-77411CRITICALRabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstrEPSS 0.5%CVE-2026-77412HIGHRabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP ClientEPSS 0.5%CVE-2026-77410HIGHRabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer AllocationEPSS 0.5%CVE-2026-77406HIGHRabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos ConfigurationEPSS 0.5%